lkml.org 
[lkml]   [2019]   [Jul]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.16 118/129] net/mlx4_core: Fix qp mtt size calculation
    3.16.70-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Jack Morgenstein <jackm@dev.mellanox.co.il>

    commit 8511a653e9250ef36b95803c375a7be0e2edb628 upstream.

    Calculation of qp mtt size (in function mlx4_RST2INIT_wrapper)
    ultimately depends on function roundup_pow_of_two.

    If the amount of memory required by the QP is less than one page,
    roundup_pow_of_two is called with argument zero. In this case, the
    roundup_pow_of_two result is undefined.

    Calling roundup_pow_of_two with a zero argument resulted in the
    following stack trace:

    UBSAN: Undefined behaviour in ./include/linux/log2.h:61:13
    shift exponent 64 is too large for 64-bit type 'long unsigned int'
    CPU: 4 PID: 26939 Comm: rping Tainted: G OE 4.19.0-rc1
    Hardware name: Supermicro X9DR3-F/X9DR3-F, BIOS 3.2a 07/09/2015
    Call Trace:
    dump_stack+0x9a/0xeb
    ubsan_epilogue+0x9/0x7c
    __ubsan_handle_shift_out_of_bounds+0x254/0x29d
    ? __ubsan_handle_load_invalid_value+0x180/0x180
    ? debug_show_all_locks+0x310/0x310
    ? sched_clock+0x5/0x10
    ? sched_clock+0x5/0x10
    ? sched_clock_cpu+0x18/0x260
    ? find_held_lock+0x35/0x1e0
    ? mlx4_RST2INIT_QP_wrapper+0xfb1/0x1440 [mlx4_core]
    mlx4_RST2INIT_QP_wrapper+0xfb1/0x1440 [mlx4_core]

    Fix this by explicitly testing for zero, and returning one if the
    argument is zero (assuming that the next higher power of 2 in this case
    should be one).

    Fixes: c82e9aa0a8bc ("mlx4_core: resource tracking for HCA resources used by guests")
    Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
    Signed-off-by: Tariq Toukan <tariqt@mellanox.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    drivers/net/ethernet/mellanox/mlx4/resource_tracker.c | 6 +++---
    1 file changed, 3 insertions(+), 3 deletions(-)

    --- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
    +++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
    @@ -2460,13 +2460,13 @@ static int qp_get_mtt_size(struct mlx4_q
    int total_pages;
    int total_mem;
    int page_offset = (be32_to_cpu(qpc->params2) >> 6) & 0x3f;
    + int tot;

    sq_size = 1 << (log_sq_size + log_sq_sride + 4);
    rq_size = (srq|rss|xrc) ? 0 : (1 << (log_rq_size + log_rq_stride + 4));
    total_mem = sq_size + rq_size;
    - total_pages =
    - roundup_pow_of_two((total_mem + (page_offset << 6)) >>
    - page_shift);
    + tot = (total_mem + (page_offset << 6)) >> page_shift;
    + total_pages = !tot ? 1 : roundup_pow_of_two(tot);

    return total_pages;
    }
    \
     
     \ /
      Last update: 2019-07-07 21:42    [W:4.413 / U:1.132 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site