Commit 3e9a458b authored by wenglianfa's avatar wenglianfa Committed by Chengchang Tang
Browse files

RDMA/hns: Fix the overflow risk of hem_list_calc_ba_range() 

driver inclusion
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/IAL7SX



----------------------------------------------------------------------

The 'unit' max value is 2^24 and the cur 'hopnum' value max value is 2,
so the 'step' value may be more than the value range of u32. To fix it,
The 'step' and context variables are changed to u64.

Fixes: 38389eaa ("RDMA/hns: Add mtr support for mixed multihop addressing")
Signed-off-by: default avatarwenglianfa <wenglianfa@huawei.com>
Signed-off-by: default avatarXinghai Cen <cenxinghai@h-partners.com>
parent 754c3a8a

drivers/infiniband/hw/hns/hns_roce_hem.c

+6 −6
Original line number Diff line number Diff line
@@ -1100,9 +1100,9 @@ static bool hem_list_is_bottom_bt(int hopnum, int bt_level) 
 * @bt_level: base address table level

 * @unit: ba entries per bt page

 */

static u32 hem_list_calc_ba_range(int hopnum, int bt_level, int unit)

static u64 hem_list_calc_ba_range(int hopnum, int bt_level, int unit)

{

	u32 step;

	u64 step;

	int max;

	int i;
@@ -1138,7 +1138,7 @@ int hns_roce_hem_list_calc_root_ba(const struct hns_roce_buf_region *regions, 
{

	struct hns_roce_buf_region *r;

	int total = 0;

	int step;

	u64 step;

	int i;



	for (i = 0; i < region_cnt; i++) {
@@ -1169,7 +1169,7 @@ static int hem_list_alloc_mid_bt(struct hns_roce_dev *hr_dev, 
	int ret = 0;

	int max_ofs;

	int level;

	u32 step;

	u64 step;

	int end;



	if (hopnum <= 1)
@@ -1206,7 +1206,7 @@ static int hem_list_alloc_mid_bt(struct hns_roce_dev *hr_dev, 
		}



		start_aligned = (distance / step) * step + r->offset;

		end = min_t(int, start_aligned + step - 1, max_ofs);

		end = min_t(u64, start_aligned + step - 1, max_ofs);

		cur = hem_list_alloc_item(hr_dev, start_aligned, end, unit,

					  true);

		if (!cur) {
@@ -1294,7 +1294,7 @@ static int setup_middle_bt(struct hns_roce_dev *hr_dev, void *cpu_base, 
	struct hns_roce_hem_item *hem, *temp_hem;

	int total = 0;

	int offset;

	int step;

	u64 step;



	step = hem_list_calc_ba_range(r->hopnum, 1, unit);

	if (step < 1)