vdpa/mlx5: Fix oversized null mkey longer than 32bit

commit a6097e0a54a5c24f8d577ffecbc35289ae281c2e upstream.

create_user_mr() has correct code to count the number of null keys
used to fill in a hole for the memory map. However, fill_indir()
does not follow the same to cap the range up to the 1GB limit
correspondingly. Fill in more null keys for the gaps in between,
so that null keys are correctly populated.

Fixes: 94abbccdf291 ("vdpa/mlx5: Add shared memory registration code")
Cc: stable@vger.kernel.org
Reported-by: Cong Meng <cong.meng@oracle.com>
Signed-off-by: Si-Wei Liu <si-wei.liu@oracle.com>
Signed-off-by: Dragos Tatulea <dtatulea@nvidia.com>
Acked-by: Eugenio Pérez <eperezma@redhat.com>
Message-Id: <20250220193732.521462-2-dtatulea@nvidia.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/vdpa/mlx5/core/mr.c b/drivers/vdpa/mlx5/core/mr.c
index 32ce1a6aae0d25a6f31ea54c30d948904736585f..59504edd1e55bf33ba5ba60742b5a35c88d0d355 100644 (file)
--- a/drivers/vdpa/mlx5/core/mr.c
+++ b/drivers/vdpa/mlx5/core/mr.c
@@ -166,9 +166,12 @@ again:
                        klm->bcount = cpu_to_be32(klm_bcount(dmr->end - dmr->start));
                        preve = dmr->end;
                } else {
+                       u64 bcount = min_t(u64, dmr->start - preve, MAX_KLM_SIZE);
+
                        klm->key = cpu_to_be32(mvdev->res.null_mkey);
-                       klm->bcount = cpu_to_be32(klm_bcount(dmr->start - preve));
-                       preve = dmr->start;
+                       klm->bcount = cpu_to_be32(klm_bcount(bcount));
+                       preve += bcount;
+
                        goto again;
                }
        }