Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7b4cdaae authored by Ilya Lesokhin's avatar Ilya Lesokhin Committed by Doug Ledford
Browse files

IB/mlx5: Fix integer overflow when page_shift == 31 



Fix a bug where MR registration fails when mlx5_ib_cont_pages
indicates that the MR can be mapped using 2GB pages (page_shift == 31).

Fixes: e126ba97 ("mlx5: Add driver for Mellanox Connect-IB adapters")
Signed-off-by: default avatarIlya Lesokhin <ilyal@mellanox.com>
Signed-off-by: default avatarLeon Romanovsky <leon@kernel.org>
Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
parent 5942d8ae

drivers/infiniband/hw/mlx5/mr.c

+5 −4
Original line number Diff line number Diff line
@@ -808,13 +808,14 @@ struct ib_mr *mlx5_ib_get_dma_mr(struct ib_pd *pd, int acc) 
	return ERR_PTR(err);

}



static int get_octo_len(u64 addr, u64 len, int page_size)

static int get_octo_len(u64 addr, u64 len, int page_shift)

{

	u64 page_size = 1ULL << page_shift;

	u64 offset;

	int npages;



	offset = addr & (page_size - 1);

	npages = ALIGN(len + offset, page_size) >> ilog2(page_size);

	npages = ALIGN(len + offset, page_size) >> page_shift;

	return (npages + 1) / 2;

}
@@ -1147,12 +1148,12 @@ static struct mlx5_ib_mr *reg_create(struct ib_mr *ibmr, struct ib_pd *pd, 
	MLX5_SET(mkc, mkc, pd, to_mpd(pd)->pdn);

	MLX5_SET(mkc, mkc, bsf_octword_size, 0);

	MLX5_SET(mkc, mkc, translations_octword_size,

		 get_octo_len(virt_addr, length, 1 << page_shift));

		 get_octo_len(virt_addr, length, page_shift));

	MLX5_SET(mkc, mkc, log_page_size, page_shift);

	MLX5_SET(mkc, mkc, qpn, 0xffffff);

	if (populate) {

		MLX5_SET(create_mkey_in, in, translations_octword_actual_size,

			 get_octo_len(virt_addr, length, 1 << page_shift));

			 get_octo_len(virt_addr, length, page_shift));

	}



	err = mlx5_core_create_mkey(dev->mdev, &mr->mmkey, in, inlen);