Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Mon, 31 Aug 2020 22:37:09 +0800
From:   Shung-Hsi Yu <shung-hsi.yu@suse.com>
To:     "David S. Miller" <davem@davemloft.net>,
        Tariq Toukan <tariqt@nvidia.com>,
        Jakub Kicinski <kuba@kernel.org>
Cc:     netdev@vger.kernel.org, linux-rdma@vger.kernel.org,
        linux-kernel@vger.kernel.org
Subject: [PATCH net] net: ethernet: mlx4: Fix memory allocation in
 mlx4_buddy_init()
Message-ID: <20200831143709.GA12996@syu-laptop>
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
MIME-Version: 1.0
X-MS-Exchange-MessageSentRepresentingType: 1
Received: from syu-laptop (27.242.32.233) by HK2PR02CA0173.apcprd02.prod.outlook.com (2603:1096:201:1f::33) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3326.19 via Frontend Transport; Mon, 31 Aug 2020 14:37:23 +0000
X-Originating-IP: [27.242.32.233]
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id: 96a6b613-c12b-4e86-aad1-08d84dbb61f9
X-MS-TrafficTypeDiagnostic: DB7PR04MB4139:
X-Microsoft-Antispam-PRVS: <DB7PR04MB4139E7C5B383AAA72ECD4D09BF510@DB7PR04MB4139.eurprd04.prod.outlook.com>
X-MS-Oob-TLC-OOBClassifiers: OLM:949;
X-MS-Exchange-SenderADCheck: 1
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: lmGsbyXLvgcIlJiEvka8CLJQhdY4pIULkQm7ebwtXMl9jM8K73eMT8usla5iusRdcHzBvFErIq8F1gYaeKYiIv/Yx79oYvpaJdDZtXjlMnCqKhCdz2ZE2YCcGM0p94TSWtlmF8h+nJgJFOD/5UF8OXg1BGBQ9LyHTIkF9htTpkhmtx+WurJMWBGKjxkM8dFm+GN3vumJxC1WJlYQt0zL+M7CP2TaH4fLu3A59L2UPeCojj7QtZ5YAlh+6P7DsrXOBn1H8Rbmy5pvra/S/4GOIge+rMc/u4vTIOimjZojMeMCTXeI0CJewdJbSB4mboTiOcuFaMJXeGhJeYAh3d4XHg==
X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:DB7PR04MB5177.eurprd04.prod.outlook.com;PTR:;CAT:NONE;SFS:(396003)(366004)(346002)(136003)(39860400002)(376002)(1076003)(9686003)(110136005)(6666004)(956004)(52116002)(55016002)(4326008)(5660300002)(6496006)(33656002)(186003)(66946007)(83380400001)(8676002)(478600001)(26005)(33716001)(16526019)(66556008)(66476007)(86362001)(8936002)(316002)(2906002);DIR:OUT;SFP:1101;
X-MS-Exchange-AntiSpam-MessageData: +wFj+oOtQQTSnkO6a1CI/QIzqu4pQ7UwW61wRio//jRFfSOZbJWSHwhUU1SaVidkSu47RX6FNJUb4RZSDEr+jLzUqlEXj3Rsj3QogMtYHho0X4XG+5a515jLVl1dTyPcoNeJ1bWTtggi0UxD4ruoDfWWAQcrJ7DflpbdPFB3IAc5lqC6YPIqcicSWGPpdI8ymtbSL4ML2Ir/YQDjEM7s2YepHIn0yjqU1BFDVB1zFr70ZQ09gOJ+IW6PfDpRErN2qjcQsWw9MAk7oXYVUKlDqecv5/dV8AcVK/Df5U5NuuqPxc3MBMSLp1627Q5na8ONzTHXvIGleeZLS3hRl+Rze2kwNAIPldikwaQA4nFfKBFsW+dB8EmqaAa2sVqmlK0s5a/F6/T6s8A2LI7nY3cPO+BmmZPn2tmkhXhO0OBYU4iiFOh287HB9/eSSFYcdYj1gGT2vrRvQt8v1iIVc4+sPox7mdkQMyjqPnoOwy4ab6hmYiDA2U4KKpega3mBTj1xRYL8aOAHhiApuDXZhPs/ZmKKGLOpbBt//6kLewzb/Y+6YqRNYPDhJWu1q0PuyuCcnsKKxqWWVX/NYFXur/VjO7/NYVljiJoPQsZJa4GVUVlrEvyoxWFgfRBk2lv6kzH3eaWDLEfCMecnlxIs6EAPUA==
X-OriginatorOrg: suse.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 96a6b613-c12b-4e86-aad1-08d84dbb61f9
X-MS-Exchange-CrossTenant-AuthSource: DB7PR04MB5177.eurprd04.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 31 Aug 2020 14:37:27.2039
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: f7a17af6-1c5c-4a36-aa8b-f5be247aa4ba
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: Aoa2OjiDj5HPVnrUeVDK0rfw8/3RD5H7j22bRCcKXLMOasgX9fwJE4vKxhf/FnOcIl2XOq8JXbxlwYM7yKPc3g==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB7PR04MB4139
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On machines with much memory (> 2 TByte) and log_mtts_per_seg == 0, a
max_order of 31 will be passed to mlx_buddy_init(), which results in
s = BITS_TO_LONGS(1 << 31) becoming a negative value, leading to
kvmalloc_array() failure when it is converted to size_t.

  mlx4_core 0000:b1:00.0: Failed to initialize memory region table, aborting
  mlx4_core: probe of 0000:b1:00.0 failed with error -12

Fix this issue by changing the left shifting operand from a signed literal to
an unsigned one.

Fixes: 225c7b1feef1 ("IB/mlx4: Add a driver Mellanox ConnectX InfiniBand adapters")
Signed-off-by: Shung-Hsi Yu <shung-hsi.yu@suse.com>
---
 drivers/net/ethernet/mellanox/mlx4/mr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/mellanox/mlx4/mr.c b/drivers/net/ethernet/mellanox/mlx4/mr.c
index d2986f1f2db0..d7444782bfdd 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mr.c
+++ b/drivers/net/ethernet/mellanox/mlx4/mr.c
@@ -114,7 +114,7 @@ static int mlx4_buddy_init(struct mlx4_buddy *buddy, int max_order)
 		goto err_out;
 
 	for (i = 0; i <= buddy->max_order; ++i) {
-		s = BITS_TO_LONGS(1 << (buddy->max_order - i));
+		s = BITS_TO_LONGS(1UL << (buddy->max_order - i));
 		buddy->bits[i] = kvmalloc_array(s, sizeof(long), GFP_KERNEL | __GFP_ZERO);
 		if (!buddy->bits[i])
 			goto err_out_free;
-- 
2.28.0