projects / thirdparty / kernel / stable-queue.git / blame
| Commit | Line | Data |
|---|---|---|
| 8cbcfc8d GKH |
1 | From foo@baz Fri Mar 15 21:00:09 PDT 2019 |
| 2 | From: Jack Morgenstein <jackm@dev.mellanox.co.il> | |
| 3 | Date: Tue, 12 Mar 2019 17:05:49 +0200 | |
| 4 | Subject: net/mlx4_core: Fix qp mtt size calculation | |
| 5 | ||
| 6 | From: Jack Morgenstein <jackm@dev.mellanox.co.il> | |
| 7 | ||
| 8 | [ Upstream commit 8511a653e9250ef36b95803c375a7be0e2edb628 ] | |
| 9 | ||
| 10 | Calculation of qp mtt size (in function mlx4_RST2INIT_wrapper) | |
| 11 | ultimately depends on function roundup_pow_of_two. | |
| 12 | ||
| 13 | If the amount of memory required by the QP is less than one page, | |
| 14 | roundup_pow_of_two is called with argument zero. In this case, the | |
| 15 | roundup_pow_of_two result is undefined. | |
| 16 | ||
| 17 | Calling roundup_pow_of_two with a zero argument resulted in the | |
| 18 | following stack trace: | |
| 19 | ||
| 20 | UBSAN: Undefined behaviour in ./include/linux/log2.h:61:13 | |
| 21 | shift exponent 64 is too large for 64-bit type 'long unsigned int' | |
| 22 | CPU: 4 PID: 26939 Comm: rping Tainted: G OE 4.19.0-rc1 | |
| 23 | Hardware name: Supermicro X9DR3-F/X9DR3-F, BIOS 3.2a 07/09/2015 | |
| 24 | Call Trace: | |
| 25 | dump_stack+0x9a/0xeb | |
| 26 | ubsan_epilogue+0x9/0x7c | |
| 27 | __ubsan_handle_shift_out_of_bounds+0x254/0x29d | |
| 28 | ? __ubsan_handle_load_invalid_value+0x180/0x180 | |
| 29 | ? debug_show_all_locks+0x310/0x310 | |
| 30 | ? sched_clock+0x5/0x10 | |
| 31 | ? sched_clock+0x5/0x10 | |
| 32 | ? sched_clock_cpu+0x18/0x260 | |
| 33 | ? find_held_lock+0x35/0x1e0 | |
| 34 | ? mlx4_RST2INIT_QP_wrapper+0xfb1/0x1440 [mlx4_core] | |
| 35 | mlx4_RST2INIT_QP_wrapper+0xfb1/0x1440 [mlx4_core] | |
| 36 | ||
| 37 | Fix this by explicitly testing for zero, and returning one if the | |
| 38 | argument is zero (assuming that the next higher power of 2 in this case | |
| 39 | should be one). | |
| 40 | ||
| 41 | Fixes: c82e9aa0a8bc ("mlx4_core: resource tracking for HCA resources used by guests") | |
| 42 | Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il> | |
| 43 | Signed-off-by: Tariq Toukan <tariqt@mellanox.com> | |
| 44 | Signed-off-by: David S. Miller <davem@davemloft.net> | |
| 45 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | |
| 46 | --- | |
| 47 | drivers/net/ethernet/mellanox/mlx4/resource_tracker.c | 6 +++--- | |
| 48 | 1 file changed, 3 insertions(+), 3 deletions(-) | |
| 49 | ||
| 50 | --- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c | |
| 51 | +++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c | |
| 52 | @@ -2677,13 +2677,13 @@ static int qp_get_mtt_size(struct mlx4_q | |
| 53 | int total_pages; | |
| 54 | int total_mem; | |
| 55 | int page_offset = (be32_to_cpu(qpc->params2) >> 6) & 0x3f; | |
| 56 | + int tot; | |
| 57 | ||
| 58 | sq_size = 1 << (log_sq_size + log_sq_sride + 4); | |
| 59 | rq_size = (srq|rss|xrc) ? 0 : (1 << (log_rq_size + log_rq_stride + 4)); | |
| 60 | total_mem = sq_size + rq_size; | |
| 61 | - total_pages = | |
| 62 | - roundup_pow_of_two((total_mem + (page_offset << 6)) >> | |
| 63 | - page_shift); | |
| 64 | + tot = (total_mem + (page_offset << 6)) >> page_shift; | |
| 65 | + total_pages = !tot ? 1 : roundup_pow_of_two(tot); | |
| 66 | ||
| 67 | return total_pages; | |
| 68 | } |