# DF-2438 fix (authored post-verification; not applied to sys/) --- a/sys/dev/disk/dm/delay/dm_target_delay.c +++ b/sys/dev/disk/dm/delay/dm_target_delay.c @@ -138,5 +138,9 @@ di->pdev = dmp; di->offset = atoi64(argv[1]); tmp = atoi64(argv[2]); - di->delay = tmp * hz / 1000; + /* compute in 64-bit and reject values that cannot be represented + * as a signed tick count instead of letting int arithmetic wrap */ + if (tmp < 0 || (tmp * (int64_t)hz) / 1000 > __INT_MAX__) + return EINVAL; + di->delay = (int)((tmp * (int64_t)hz) / 1000); di->count = 0;