max_cmds is declared as u16 but the calculation:
scsi_qdepth + IBMVFC_NUM_INTERNAL_REQ +
(scsi_qdepth + IBMVFC_NUM_INTERNAL_SUBQ_REQ) *
(scsi_scrqs.desired_queues + nvme_scrqs.desired_queues)
can exceed 65535 at non-extreme configurations. With scsi_qdepth=2048
and 32 total desired queues (16 SCSI + 16 NVMe maximum), the subqueue
term alone evaluates to 2052 * 32 = 65664, which silently wraps to 128
in a u16, causing the NPIV login MAD to advertise a badly corrupted
command slot count to the VIOS.
The wire field login_info->max_cmds is already __be32, so widen the
local variable to u32 to match, making the arithmetic safe across all
supported module parameter combinations.
Fixes: ecc03d958e37 ("ibmvfc: add logic for protocol specific fabric logins")
Signed-off-by: Tyrel Datwyler <[email protected]>
---
drivers/scsi/ibmvscsi/ibmvfc-core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/scsi/ibmvscsi/ibmvfc-core.c
b/drivers/scsi/ibmvscsi/ibmvfc-core.c
index 70771f6420d9..623fff503040 100644
--- a/drivers/scsi/ibmvscsi/ibmvfc-core.c
+++ b/drivers/scsi/ibmvscsi/ibmvfc-core.c
@@ -1566,7 +1566,7 @@ static void ibmvfc_set_login_info(struct ibmvfc_host
*vhost)
struct ibmvfc_queue *async_crq = &vhost->async_crq;
struct device_node *of_node = vhost->dev->of_node;
const char *location;
- u16 max_cmds;
+ u32 max_cmds;
max_cmds = scsi_qdepth + IBMVFC_NUM_INTERNAL_REQ;
if (mq_enabled)
--
2.55.0
