Commit d586628b authored by wenglianfa's avatar wenglianfa Committed by Leon Romanovsky

RDMA/hns: Fix the overflow risk of hem_list_calc_ba_range()

The max value of 'unit' and 'hop_num' is 2^24 and 2, so the value of
'step' may exceed the range of u32. Change the type of 'step' to u64.

Fixes: 38389eaa ("RDMA/hns: Add mtr support for mixed multihop addressing")
Signed-off-by: default avatarwenglianfa <wenglianfa@huawei.com>
Signed-off-by: default avatarJunxian Huang <huangjunxian6@hisilicon.com>
Link: https://patch.msgid.link/20240906093444.3571619-5-huangjunxian6@hisilicon.comSigned-off-by: default avatarLeon Romanovsky <leon@kernel.org>
parent fd848929
...@@ -1041,9 +1041,9 @@ static bool hem_list_is_bottom_bt(int hopnum, int bt_level) ...@@ -1041,9 +1041,9 @@ static bool hem_list_is_bottom_bt(int hopnum, int bt_level)
* @bt_level: base address table level * @bt_level: base address table level
* @unit: ba entries per bt page * @unit: ba entries per bt page
*/ */
static u32 hem_list_calc_ba_range(int hopnum, int bt_level, int unit) static u64 hem_list_calc_ba_range(int hopnum, int bt_level, int unit)
{ {
u32 step; u64 step;
int max; int max;
int i; int i;
...@@ -1079,7 +1079,7 @@ int hns_roce_hem_list_calc_root_ba(const struct hns_roce_buf_region *regions, ...@@ -1079,7 +1079,7 @@ int hns_roce_hem_list_calc_root_ba(const struct hns_roce_buf_region *regions,
{ {
struct hns_roce_buf_region *r; struct hns_roce_buf_region *r;
int total = 0; int total = 0;
int step; u64 step;
int i; int i;
for (i = 0; i < region_cnt; i++) { for (i = 0; i < region_cnt; i++) {
...@@ -1110,7 +1110,7 @@ static int hem_list_alloc_mid_bt(struct hns_roce_dev *hr_dev, ...@@ -1110,7 +1110,7 @@ static int hem_list_alloc_mid_bt(struct hns_roce_dev *hr_dev,
int ret = 0; int ret = 0;
int max_ofs; int max_ofs;
int level; int level;
u32 step; u64 step;
int end; int end;
if (hopnum <= 1) if (hopnum <= 1)
...@@ -1147,7 +1147,7 @@ static int hem_list_alloc_mid_bt(struct hns_roce_dev *hr_dev, ...@@ -1147,7 +1147,7 @@ static int hem_list_alloc_mid_bt(struct hns_roce_dev *hr_dev,
} }
start_aligned = (distance / step) * step + r->offset; start_aligned = (distance / step) * step + r->offset;
end = min_t(int, start_aligned + step - 1, max_ofs); end = min_t(u64, start_aligned + step - 1, max_ofs);
cur = hem_list_alloc_item(hr_dev, start_aligned, end, unit, cur = hem_list_alloc_item(hr_dev, start_aligned, end, unit,
true); true);
if (!cur) { if (!cur) {
...@@ -1235,7 +1235,7 @@ static int setup_middle_bt(struct hns_roce_dev *hr_dev, void *cpu_base, ...@@ -1235,7 +1235,7 @@ static int setup_middle_bt(struct hns_roce_dev *hr_dev, void *cpu_base,
struct hns_roce_hem_item *hem, *temp_hem; struct hns_roce_hem_item *hem, *temp_hem;
int total = 0; int total = 0;
int offset; int offset;
int step; u64 step;
step = hem_list_calc_ba_range(r->hopnum, 1, unit); step = hem_list_calc_ba_range(r->hopnum, 1, unit);
if (step < 1) if (step < 1)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment