Commit a976860a authored by wenglianfa's avatar wenglianfa Committed by Chengchang Tang
Browse files

RDMA/hns: Fix the overflow risk of hem_list_calc_ba_range() 

driver inclusion
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/IATYMO



----------------------------------------------------------------------

The max value of 'unit' and 'hop_num' is 2^24 and 2, so the value of
'step' may exceed the range of u32. Change the type of 'step' to u64.

Fixes: 38389eaa ("RDMA/hns: Add mtr support for mixed multihop addressing")
Signed-off-by: default avatarwenglianfa <wenglianfa@huawei.com>
Signed-off-by: default avatarJunxian Huang <huangjunxian6@hisilicon.com>
Link: https://patch.msgid.link/20240906093444.3571619-5-huangjunxian6@hisilicon.com


Signed-off-by: default avatarLeon Romanovsky <leon@kernel.org>
Signed-off-by: default avatarXinghai Cen <cenxinghai@h-partners.com>
parent 503de6c4

drivers/infiniband/hw/hns/hns_roce_hem.c

+6 −6
Original line number Diff line number Diff line
@@ -1042,9 +1042,9 @@ static bool hem_list_is_bottom_bt(int hopnum, int bt_level) 
 * @bt_level: base address table level

 * @unit: ba entries per bt page

 */

static u32 hem_list_calc_ba_range(int hopnum, int bt_level, int unit)

static u64 hem_list_calc_ba_range(int hopnum, int bt_level, int unit)

{

	u32 step;

	u64 step;

	int max;

	int i;
@@ -1080,7 +1080,7 @@ int hns_roce_hem_list_calc_root_ba(const struct hns_roce_buf_region *regions, 
{

	struct hns_roce_buf_region *r;

	int total = 0;

	int step;

	u64 step;

	int i;



	for (i = 0; i < region_cnt; i++) {
@@ -1111,7 +1111,7 @@ static int hem_list_alloc_mid_bt(struct hns_roce_dev *hr_dev, 
	int ret = 0;

	int max_ofs;

	int level;

	u32 step;

	u64 step;

	int end;



	if (hopnum <= 1)
@@ -1150,7 +1150,7 @@ static int hem_list_alloc_mid_bt(struct hns_roce_dev *hr_dev, 
		}



		start_aligned = (distance / step) * step + r->offset;

		end = min_t(int, start_aligned + step - 1, max_ofs);

		end = min_t(u64, start_aligned + step - 1, max_ofs);

		cur = hem_list_alloc_item(hr_dev, start_aligned, end, unit,

					  true);

		if (!cur) {
@@ -1238,7 +1238,7 @@ static int setup_middle_bt(struct hns_roce_dev *hr_dev, void *cpu_base, 
	struct hns_roce_hem_item *hem, *temp_hem;

	int total = 0;

	int offset;

	int step;

	u64 step;



	step = hem_list_calc_ba_range(r->hopnum, 1, unit);

	if (step < 1)