NetBSD Problem Report #60902

From www@netbsd.org  Sun Oct 18 20:53:12 2026
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "mail.netbsd.org", Issuer "YR1" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 1E8141A923B
	for <gnats-bugs@gnats.NetBSD.org>; Sun, 18 Oct 2026 20:53:12 +0000 (UTC)
Message-Id: <20261018205310.B3DF91A923C@mollari.NetBSD.org>
Date: Sun, 18 Oct 2026 20:53:10 +0000 (UTC)
From: joe@ns1.eloisystems.com
Reply-To: joe@ns1.eloisystems.com
To: gnats-bugs@NetBSD.org
Subject: Overflow in dbcool when setting voltage limit
X-Send-Pr-Version: www-1.0
X-From4GNATS: "joe@ns1.eloisystems.com via gnats" <gnats-admin@NetBSD.org>

>Number:         60902
>Category:       kern
>Synopsis:       Overflow in dbcool when setting voltage limit
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Oct 18 20:55:00 +0000 2026
>Last-Modified:  Sun Oct 18 21:10:02 +0000 2026
>Originator:     Emmanuel Nyarko
>Release:        NetBSD current
>Organization:
NetBSD
>Environment:
NetBSD celery.zia.io 11.0_STABLE NetBSD 11.0_STABLE (GENERIC) #0: Fri Aug 21 06:09:16 UTC 2026  john@celery.zia.io:/usr/obj-amd64/sys/arch/amd64/compile/GENERIC amd64
>Description:

dbcool driver keeps a int64_t nominal voltage array containing values in million ranges.

in setting voltage limits based on these nominal voltages, the values are multiplied by 

 1 million to scale in micorvolts and stored in ints.


8 of these values overflow the integer storing the voltage nom.
>How-To-Repeat:

from code inspection
>Fix:

Index: sys/dev/i2c/dbcool.c
===================================================================
RCS file: /cvsroot/src/sys/dev/i2c/dbcool.c,v
retrieving revision 1.70
diff -u -r1.70 dbcool.c
--- sys/dev/i2c/dbcool.c        3 Sep 2026 05:32:06 -0000       1.70
+++ sys/dev/i2c/dbcool.c        18 Oct 2026 20:48:49 -0000
@@ -2019,7 +2019,7 @@
 {
        struct reg_list *reg = sc->sc_regs[idx];
        int64_t limit;
-       int nom;
+       int64_t nom;

        nom = nominal_voltages[sc->sc_dc.dc_chip->table[idx].nom_volt_index];
        if (nom < 0)
@@ -2154,7 +2154,7 @@
 {
        struct reg_list *reg = sc->sc_regs[idx];
        int64_t limit;
-       int nom;
+       int64_t nom;

        nom = nominal_voltages[sc->sc_dc.dc_chip->table[idx].nom_volt_index];
        if (nom < 0)
joe@Emmanuels-MBP src % 

>Audit-Trail:
From: "Emmanuel" <joe@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60902 CVS commit: src/sys/dev/i2c
Date: Sun, 18 Oct 2026 21:08:58 +0000

 Module Name:	src
 Committed By:	joe
 Date:		Sun Oct 18 21:08:58 UTC 2026

 Modified Files:
 	src/sys/dev/i2c: dbcool.c

 Log Message:
 PR kern/60902

 change nom type from int to int64_t to avoid overflowing for 8 of the nominal voltage values:


 To generate a diff of this commit:
 cvs rdiff -u -r1.70 -r1.71 src/sys/dev/i2c/dbcool.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

Home	PR Database Search