| Message ID | 1542961598-91107-4-git-send-email-oulijun@huawei.com (mailing list archive) |
|---|---|
| State | Changes Requested |
| Headers | show |
| Series | Misc fixes for hip08 | expand |
On Fri, Nov 23, 2018 at 04:26:37PM +0800, Lijun Ou wrote: > It will access the border when defines the pbl for int and. > This patch fix it. I have no idea what this menas. I think it is trying to say pbl_size has to be a u64 to prevent multiply overflow? Jason
在 2018/11/24 4:27, Jason Gunthorpe 写道: > On Fri, Nov 23, 2018 at 04:26:37PM +0800, Lijun Ou wrote: >> It will access the border when defines the pbl for int and. >> This patch fix it. > I have no idea what this menas. I think it is trying to say pbl_size > has to be a u64 to prevent multiply overflow? > > Jason Yes. When pbl size is large, the u32 will lead to overflow. >
diff --git a/drivers/infiniband/hw/hns/hns_roce_mr.c b/drivers/infiniband/hw/hns/hns_roce_mr.c index fabc95d..ee5991b 100644 --- a/drivers/infiniband/hw/hns/hns_roce_mr.c +++ b/drivers/infiniband/hw/hns/hns_roce_mr.c @@ -1128,14 +1128,14 @@ struct ib_mr *hns_roce_reg_user_mr(struct ib_pd *pd, u64 start, u64 length, goto err_umem; } } else { - int pbl_size = 1; + u64 pbl_size = 1; bt_size = (1 << (hr_dev->caps.pbl_ba_pg_sz + PAGE_SHIFT)) / 8; for (i = 0; i < hr_dev->caps.pbl_hop_num; i++) pbl_size *= bt_size; if (n > pbl_size) { dev_err(dev, - " MR len %lld err. MR page num is limited to %d!\n", + " MR len %lld err. MR page num is limited to %lld!\n", length, pbl_size); ret = -EINVAL; goto err_umem;
It will access the border when defines the pbl for int and. This patch fix it. Signed-off-by: Lijun Ou <oulijun@huawei.com> --- V1->V2: 1. Remove the build warning --- drivers/infiniband/hw/hns/hns_roce_mr.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)