Commit 131be267 authored by Parav Pandit's avatar Parav Pandit Committed by Jason Gunthorpe
Browse files

IB/cm: Avoid a loop when device has 255 ports 

When RDMA device has 255 ports, loop iterator i overflows.  Due to which
cm_add_one() port iterator loops infinitely.  Use core provided port
iterator to avoid the infinite loop.

Fixes: a977049d ("[PATCH] IB: Add the kernel CM implementation")
Link: https://lore.kernel.org/r/20210127150010.1876121-9-leon@kernel.org


Signed-off-by: default avatarMark Bloch <mbloch@nvidia.com>
Signed-off-by: default avatarParav Pandit <parav@nvidia.com>
Signed-off-by: default avatarLeon Romanovsky <leonro@nvidia.com>
Signed-off-by: default avatarJason Gunthorpe <jgg@nvidia.com>
parent d286ac1d

drivers/infiniband/core/cm.c

+4 −4
Original line number Original line Diff line number Diff line
@@ -4333,7 +4333,7 @@ static int cm_add_one(struct ib_device *ib_device) 
	unsigned long flags;

	unsigned long flags;

	int ret;

	int ret;

	int count = 0;

	int count = 0;

	u8 i;

	unsigned int i;





	cm_dev = kzalloc(struct_size(cm_dev, port, ib_device->phys_port_cnt),

	cm_dev = kzalloc(struct_size(cm_dev, port, ib_device->phys_port_cnt),

			 GFP_KERNEL);

			 GFP_KERNEL);
@@ -4345,7 +4345,7 @@ static int cm_add_one(struct ib_device *ib_device) 
	cm_dev->going_down = 0;

	cm_dev->going_down = 0;





	set_bit(IB_MGMT_METHOD_SEND, reg_req.method_mask);

	set_bit(IB_MGMT_METHOD_SEND, reg_req.method_mask);

	for (i = 1; i <= ib_device->phys_port_cnt; i++) {

	rdma_for_each_port (ib_device, i) {

		if (!rdma_cap_ib_cm(ib_device, i))

		if (!rdma_cap_ib_cm(ib_device, i))

			continue;

			continue;
@@ -4431,7 +4431,7 @@ static void cm_remove_one(struct ib_device *ib_device, void *client_data) 
		.clr_port_cap_mask = IB_PORT_CM_SUP

		.clr_port_cap_mask = IB_PORT_CM_SUP

	};

	};

	unsigned long flags;

	unsigned long flags;

	int i;

	unsigned int i;





	write_lock_irqsave(&cm.device_lock, flags);

	write_lock_irqsave(&cm.device_lock, flags);

	list_del(&cm_dev->list);

	list_del(&cm_dev->list);
@@ -4441,7 +4441,7 @@ static void cm_remove_one(struct ib_device *ib_device, void *client_data) 
	cm_dev->going_down = 1;

	cm_dev->going_down = 1;

	spin_unlock_irq(&cm.lock);

	spin_unlock_irq(&cm.lock);





	for (i = 1; i <= ib_device->phys_port_cnt; i++) {

	rdma_for_each_port (ib_device, i) {

		if (!rdma_cap_ib_cm(ib_device, i))

		if (!rdma_cap_ib_cm(ib_device, i))

			continue;

			continue;