]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
RDMA/mlx5: Handle errors returned from mlx5r_ib_rate()
authorQasim Ijaz <qasdev00@gmail.com>
Tue, 4 Mar 2025 14:02:46 +0000 (14:02 +0000)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 28 Mar 2025 21:03:26 +0000 (22:03 +0100)
commit7c2a5a535cbdacc1f09cc1c13c65cd057ebabcf5
tree7bc564d47ca7b2e7c61572a940a74e84a2718f02
parentadeba5b0d1208bc29112004478fc440953c658dd
RDMA/mlx5: Handle errors returned from mlx5r_ib_rate()

[ Upstream commit 556f93b90c1872ad85e216e613c0b33803e621cb ]

In function create_ib_ah() the following line attempts
to left shift the return value of mlx5r_ib_rate() by 4
and store it in the stat_rate_sl member of av:

However the code overlooks the fact that mlx5r_ib_rate()
may return -EINVAL if the rate passed to it is less than
IB_RATE_2_5_GBPS or greater than IB_RATE_800_GBPS.

Because of this, the code may invoke undefined behaviour when
shifting a signed negative value when doing "-EINVAL << 4".

To fix this check for errors before assigning stat_rate_sl and
propagate any error value to the callers.

Fixes: c534ffda781f ("RDMA/mlx5: Fix AH static rate parsing")
Signed-off-by: Qasim Ijaz <qasdev00@gmail.com>
Link: https://patch.msgid.link/20250304140246.205919-1-qasdev00@gmail.com
Reviewed-by: Patrisious Haddad <phaddad@nvidia.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/infiniband/hw/mlx5/ah.c