RDMA/hns: Check atomic wr length

[ Upstream commit 6afa2c0bfb8ef69f65715ae059e5bd5f9bbaf03b ]

8 bytes is the only supported length of atomic. Add this check in
set_rc_wqe(). Besides, stop processing WQEs and return from
set_rc_wqe() if there is any error.

Fixes: 384f88185112 ("RDMA/hns: Add atomic support")
Signed-off-by: Junxian Huang <huangjunxian6@hisilicon.com>
Link: https://lore.kernel.org/r/20240710133705.896445-2-huangjunxian6@hisilicon.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/infiniband/hw/hns/hns_roce_device.h b/drivers/infiniband/hw/hns/hns_roce_device.h
index ff0b3f68ee3a4008b69cbfc44ebf43994682ea77..05005079258cf9c8009d229692c95cb98005681a 100644 (file)
--- a/drivers/infiniband/hw/hns/hns_roce_device.h
+++ b/drivers/infiniband/hw/hns/hns_roce_device.h
@@ -91,6 +91,8 @@
 /* Configure to HW for PAGE_SIZE larger than 4KB */
 #define PG_SHIFT_OFFSET                                (PAGE_SHIFT - 12)
 
+#define ATOMIC_WR_LEN                          8
+
 #define HNS_ROCE_IDX_QUE_ENTRY_SZ              4
 #define SRQ_DB_REG                             0x230
 

diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
index 4287818a737f9780e15efc77bdb522bbed18c571..eb6052ee89383f1b130457354626b327aee81422 100644 (file)
--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
@@ -591,11 +591,16 @@ static inline int set_rc_wqe(struct hns_roce_qp *qp,
                     (wr->send_flags & IB_SEND_SIGNALED) ? 1 : 0);
 
        if (wr->opcode == IB_WR_ATOMIC_CMP_AND_SWP ||
-           wr->opcode == IB_WR_ATOMIC_FETCH_AND_ADD)
+           wr->opcode == IB_WR_ATOMIC_FETCH_AND_ADD) {
+               if (msg_len != ATOMIC_WR_LEN)
+                       return -EINVAL;
                set_atomic_seg(wr, rc_sq_wqe, valid_num_sge);
-       else if (wr->opcode != IB_WR_REG_MR)
+       } else if (wr->opcode != IB_WR_REG_MR) {
                ret = set_rwqe_data_seg(&qp->ibqp, wr, rc_sq_wqe,
                                        &curr_idx, valid_num_sge);
+               if (ret)
+                       return ret;
+       }
 
        /*
         * The pipeline can sequentially post all valid WQEs into WQ buffer,