Commit 1f700757 authored by Shiraz Saleem's avatar Shiraz Saleem Committed by Jason Gunthorpe
Browse files

RDMA/irdma: Fix potential overflow expression in irdma_prm_get_pbles 

Coverity reports a signed 32-bit overflow on "1 << pprm->pble_shift" when
used expression to compute bits_needed that expects 64bit, unsigned.

Fix this by using the 1ULL in the left shift operator and convert mem_size
to u64.

Link: https://lore.kernel.org/r/20210625162329.1654-3-tatyana.e.nikolova@intel.com


Reported-by: default avatarcoverity-bot <keescook+coverity-bot@chromium.org>
Addresses-Coverity-ID: 1505157 ("Integer handling issues")
Fixes: 915cc7ac ("RDMA/irdma: Add miscellaneous utility definitions")
Signed-off-by: default avatarShiraz Saleem <shiraz.saleem@intel.com>
Signed-off-by: default avatarTatyana Nikolova <tatyana.e.nikolova@intel.com>
Signed-off-by: default avatarJason Gunthorpe <jgg@nvidia.com>
parent 46308965

drivers/infiniband/hw/irdma/pble.h

+1 −1
Original line number Diff line number Diff line
@@ -121,7 +121,7 @@ enum irdma_status_code irdma_prm_add_pble_mem(struct irdma_pble_prm *pprm, 
					      struct irdma_chunk *pchunk);

enum irdma_status_code

irdma_prm_get_pbles(struct irdma_pble_prm *pprm,

		    struct irdma_pble_chunkinfo *chunkinfo, u32 mem_size,

		    struct irdma_pble_chunkinfo *chunkinfo, u64 mem_size,

		    u64 **vaddr, u64 *fpm_addr);

void irdma_prm_return_pbles(struct irdma_pble_prm *pprm,

			    struct irdma_pble_chunkinfo *chunkinfo);

drivers/infiniband/hw/irdma/utils.c

+2 −2
Original line number Diff line number Diff line
@@ -2314,7 +2314,7 @@ enum irdma_status_code irdma_prm_add_pble_mem(struct irdma_pble_prm *pprm, 
 */

enum irdma_status_code

irdma_prm_get_pbles(struct irdma_pble_prm *pprm,

		    struct irdma_pble_chunkinfo *chunkinfo, u32 mem_size,

		    struct irdma_pble_chunkinfo *chunkinfo, u64 mem_size,

		    u64 **vaddr, u64 *fpm_addr)

{

	u64 bits_needed;
@@ -2326,7 +2326,7 @@ irdma_prm_get_pbles(struct irdma_pble_prm *pprm, 
	*vaddr = NULL;

	*fpm_addr = 0;



	bits_needed = (mem_size + (1 << pprm->pble_shift) - 1) >> pprm->pble_shift;

	bits_needed = DIV_ROUND_UP_ULL(mem_size, BIT_ULL(pprm->pble_shift));



	spin_lock_irqsave(&pprm->prm_lock, flags);

	while (chunk_entry != &pprm->clist) {