From: Thomas Bogendoerfer <tbogendoerfer@suse.de>
Subject: kABI: protect struct mlx5_core_srq
Patch-Mainline: never, kABI
References: bsc#1046305 FATE#322943

Fix c2b37f76485f ("IB/mlx5: Fix integer overflows in mlx5_ib_create_srq")
changed size of max_gs and max_avail_gather in struct mlx5_core_srq.
The two fields are only used inside mlx5 IB module. Use new fields
for it.

Signed-off-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
---
 drivers/infiniband/hw/mlx5/srq.c |   12 ++++++------
 include/linux/mlx5/driver.h      |    8 ++++++--
 2 files changed, 12 insertions(+), 8 deletions(-)

--- a/drivers/infiniband/hw/mlx5/srq.c
+++ b/drivers/infiniband/hw/mlx5/srq.c
@@ -262,11 +262,11 @@ struct ib_srq *mlx5_ib_create_srq(struct
 	mutex_init(&srq->mutex);
 	spin_lock_init(&srq->lock);
 	srq->msrq.max    = roundup_pow_of_two(init_attr->attr.max_wr + 1);
-	srq->msrq.max_gs = init_attr->attr.max_sge;
+	srq->msrq.max_gs_st = init_attr->attr.max_sge;
 
 	desc_size = sizeof(struct mlx5_wqe_srq_next_seg) +
-		    srq->msrq.max_gs * sizeof(struct mlx5_wqe_data_seg);
-	if (desc_size == 0 || srq->msrq.max_gs > desc_size) {
+		    srq->msrq.max_gs_st * sizeof(struct mlx5_wqe_data_seg);
+	if (desc_size == 0 || srq->msrq.max_gs_st > desc_size) {
 		err = -EINVAL;
 		goto err_srq;
 	}
@@ -407,7 +407,7 @@ int mlx5_ib_query_srq(struct ib_srq *ibs
 
 	srq_attr->srq_limit = out->lwm;
 	srq_attr->max_wr    = srq->msrq.max - 1;
-	srq_attr->max_sge   = srq->msrq.max_gs;
+	srq_attr->max_sge   = srq->msrq.max_gs_st;
 
 out_box:
 	kfree(out);
@@ -468,7 +468,7 @@ int mlx5_ib_post_srq_recv(struct ib_srq
 	}
 
 	for (nreq = 0; wr; nreq++, wr = wr->next) {
-		if (unlikely(wr->num_sge > srq->msrq.max_gs)) {
+		if (unlikely(wr->num_sge > srq->msrq.max_gs_st)) {
 			err = -EINVAL;
 			*bad_wr = wr;
 			break;
@@ -492,7 +492,7 @@ int mlx5_ib_post_srq_recv(struct ib_srq
 			scat[i].addr       = cpu_to_be64(wr->sg_list[i].addr);
 		}
 
-		if (i < srq->msrq.max_avail_gather) {
+		if (i < srq->msrq.max_avail_gather_st) {
 			scat[i].byte_count = 0;
 			scat[i].lkey       = cpu_to_be32(MLX5_INVALID_LKEY);
 			scat[i].addr       = 0;
--- a/include/linux/mlx5/driver.h
+++ b/include/linux/mlx5/driver.h
@@ -434,13 +434,17 @@ struct mlx5_core_srq {
 	struct mlx5_core_rsc_common	common; /* must be first */
 	u32		srqn;
 	int		max;
-	size_t		max_gs;
-	size_t		max_avail_gather;
+	int		max_gs;
+	int		max_avail_gather;
 	int		wqe_shift;
 	void (*event)	(struct mlx5_core_srq *, enum mlx5_event);
 
 	atomic_t		refcount;
 	struct completion	free;
+#ifndef __GENKSYMS__
+	size_t		max_gs_st;
+	size_t		max_avail_gather_st;
+#endif
 };
 
 struct mlx5_eq_table {