Commit b46b2c3e authored by Chengchang Tang's avatar Chengchang Tang Committed by Xinghai Cen
Browse files

RDMA/hns: Fix undifined behavior caused by invalid max_sge 

mainline inclusion
from mainline-v6.10-rc7
commit 36397b907355e2fdb5a25a02a7921a937fd8ef4c
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/IADZY7
CVE: NA

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma.git/commit/?id=36397b907355e2fdb5a25a02a7921a937fd8ef4c



---------------------------------------------------------------------

If max_sge has been set to 0, roundup_pow_of_two() in
set_srq_basic_param() may have undefined behavior.

Fixes: 9dd05247 ("RDMA/hns: Allocate one more recv SGE for HIP08")
Signed-off-by: default avatarChengchang Tang <tangchengchang@huawei.com>
Signed-off-by: default avatarJunxian Huang <huangjunxian6@hisilicon.com>
Link: https://lore.kernel.org/r/20240710133705.896445-7-huangjunxian6@hisilicon.com


Signed-off-by: default avatarLeon Romanovsky <leon@kernel.org>
Signed-off-by: default avatarXinghai Cen <cenxinghai@h-partners.com>
parent bc4f3cd2

drivers/infiniband/hw/hns/hns_roce_srq.c

+1 −1
Original line number Diff line number Diff line
@@ -338,7 +338,7 @@ static int set_srq_basic_param(struct hns_roce_srq *srq, 
	max_sge = proc_srq_sge(hr_dev, srq, !!udata);



	if (init_attr->attr.max_wr > hr_dev->caps.max_srq_wrs ||

	    init_attr->attr.max_sge > max_sge) {

	    init_attr->attr.max_sge > max_sge || !init_attr->attr.max_sge) {

		ibdev_err(&hr_dev->ib_dev,

			  "invalid SRQ attr, depth = %u, sge = %u.\n",

			   attr->max_wr, attr->max_sge);