mana_ib stores its adapter capabilities internally as u32 in struct mana_ib_adapter_caps. The IB core, however, exposes the corresponding device attributes through struct ib_device_attr, where fields such as max_qp, max_qp_wr, max_send_sge, max_recv_sge, max_sge_rd, max_cq, max_cqe, max_mr, max_pd, max_qp_rd_atom, max_res_rd_atom and max_qp_init_rd_atom are signed int.
mana_ib_query_device() is the only place that copies the cached u32 caps into these int fields. If a cap exceeds INT_MAX, the implicit u32-to-int narrowing yields a negative value. Clamp each cap to INT_MAX at this boundary so the values handed to the IB core are always non-negative. While here, fix a related overflow in the computation of max_res_rd_atom. It is derived as max_qp_rd_atom * max_qp, both of which are int after the assignment above; the multiplication can overflow an int even with the new clamps in place. Widen to s64 before multiplying and clamp the result to INT_MAX. Signed-off-by: Erni Sri Satya Vennela <[email protected]> --- Changes in v3: * Drop clamping from mana_ib_gd_query_adapter_caps(). The internal u32 caps cache does not need to be clamped. * Move all clamping exclusively to mana_ib_query_device(), which is the only place the cached u32 values are narrowed into the signed int fields of struct ib_device_attr. * Reframe commit message: this is a u32-to-int type boundary fix, not a CVM/untrusted-hardware hardening patch. Changes in v2: * Update patch title. --- drivers/infiniband/hw/mana/main.c | 33 ++++++++++++++++++++----------- 1 file changed, 21 insertions(+), 12 deletions(-) diff --git a/drivers/infiniband/hw/mana/main.c b/drivers/infiniband/hw/mana/main.c index ac5e75dd3494..ca843083140f 100644 --- a/drivers/infiniband/hw/mana/main.c +++ b/drivers/infiniband/hw/mana/main.c @@ -555,19 +555,28 @@ int mana_ib_query_device(struct ib_device *ibdev, struct ib_device_attr *props, props->vendor_part_id = dev->gdma_dev->dev_id.type; props->max_mr_size = MANA_IB_MAX_MR_SIZE; props->page_size_cap = dev->adapter_caps.page_size_cap; - props->max_qp = dev->adapter_caps.max_qp_count; - props->max_qp_wr = dev->adapter_caps.max_qp_wr; + /* + * mana_ib stores adapter capabilities internally as u32, but the + * corresponding ib_device_attr fields are signed int. Clamp each + * value at this boundary so a cap larger than INT_MAX is never + * narrowed into a negative value visible to the IB core or + * userspace. + */ + props->max_qp = min_t(u32, dev->adapter_caps.max_qp_count, INT_MAX); + props->max_qp_wr = min_t(u32, dev->adapter_caps.max_qp_wr, INT_MAX); props->device_cap_flags = IB_DEVICE_RC_RNR_NAK_GEN; - props->max_send_sge = dev->adapter_caps.max_send_sge_count; - props->max_recv_sge = dev->adapter_caps.max_recv_sge_count; - props->max_sge_rd = dev->adapter_caps.max_recv_sge_count; - props->max_cq = dev->adapter_caps.max_cq_count; - props->max_cqe = dev->adapter_caps.max_qp_wr; - props->max_mr = dev->adapter_caps.max_mr_count; - props->max_pd = dev->adapter_caps.max_pd_count; - props->max_qp_rd_atom = dev->adapter_caps.max_inbound_read_limit; - props->max_res_rd_atom = props->max_qp_rd_atom * props->max_qp; - props->max_qp_init_rd_atom = dev->adapter_caps.max_outbound_read_limit; + props->max_send_sge = min_t(u32, dev->adapter_caps.max_send_sge_count, INT_MAX); + props->max_recv_sge = min_t(u32, dev->adapter_caps.max_recv_sge_count, INT_MAX); + props->max_sge_rd = min_t(u32, dev->adapter_caps.max_recv_sge_count, INT_MAX); + props->max_cq = min_t(u32, dev->adapter_caps.max_cq_count, INT_MAX); + props->max_cqe = min_t(u32, dev->adapter_caps.max_qp_wr, INT_MAX); + props->max_mr = min_t(u32, dev->adapter_caps.max_mr_count, INT_MAX); + props->max_pd = min_t(u32, dev->adapter_caps.max_pd_count, INT_MAX); + props->max_qp_rd_atom = min_t(u32, dev->adapter_caps.max_inbound_read_limit, INT_MAX); + props->max_res_rd_atom = min_t(s64, + (s64)props->max_qp_rd_atom * props->max_qp, + INT_MAX); + props->max_qp_init_rd_atom = min_t(u32, dev->adapter_caps.max_outbound_read_limit, INT_MAX); props->atomic_cap = IB_ATOMIC_NONE; props->masked_atomic_cap = IB_ATOMIC_NONE; props->max_ah = INT_MAX; -- 2.34.1
