RDMA/hns: Fix arithmetic overflow in calc_hem_config()

If bt_num is 3 or 2, then the expressions like
l0_idx * chunk_ba_num + l1_idx are computed in 32-bit
arithmetic before being assigned to a u64 index field,
which can lead to overflow.

Cast the first operand to u64 to ensure the arithmetic
is performed in 64-bit.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 2f49de21f3e9 ("RDMA/hns: Optimize mhop get flow for multi-hop addressing")
Signed-off-by: Alexander Chesnokov <Alexander.Chesnokov@kaspersky.com>
Link: https://patch.msgid.link/20260413091527.39990-1-Alexander.Chesnokov@kaspersky.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>

diff --git a/drivers/infiniband/hw/hns/hns_roce_hem.c b/drivers/infiniband/hw/hns/hns_roce_hem.c
index e7c9e30ad2d8b44a21028c13350e928b6393ec1e..ccb40f8a48b7260b9f9b17e208fef8b5a0173518 100644 (file)
--- a/drivers/infiniband/hw/hns/hns_roce_hem.c
+++ b/drivers/infiniband/hw/hns/hns_roce_hem.c
@@ -314,14 +314,14 @@ static int calc_hem_config(struct hns_roce_dev *hr_dev,
        bt_num = hns_roce_get_bt_num(table->type, mhop->hop_num);
        switch (bt_num) {
        case 3:
-               index->l1 = l0_idx * chunk_ba_num + l1_idx;
+               index->l1 = (u64)l0_idx * chunk_ba_num + l1_idx;
                index->l0 = l0_idx;
-               index->buf = l0_idx * chunk_ba_num * chunk_ba_num +
-                            l1_idx * chunk_ba_num + l2_idx;
+               index->buf = (u64)l0_idx * chunk_ba_num * chunk_ba_num +
+                                        (u64)l1_idx * chunk_ba_num + l2_idx;
                break;
        case 2:
                index->l0 = l0_idx;
-               index->buf = l0_idx * chunk_ba_num + l1_idx;
+               index->buf = (u64)l0_idx * chunk_ba_num + l1_idx;
                break;
        case 1:
                index->buf = l0_idx;