From: Thomas Bogendoerfer <tbogendoerfer@suse.de>
Subject: kABI: protect struct mlx5_core_srq
Patch-Mainline: never, kABI
References: bsc#1046305 FATE#322943
Fix c2b37f76485f ("IB/mlx5: Fix integer overflows in mlx5_ib_create_srq")
changed size of max_gs and max_avail_gather in struct mlx5_core_srq.
The two fields are only used inside mlx5 IB module. Use new fields
for it.
Signed-off-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
---
drivers/infiniband/hw/mlx5/srq.c | 12 ++++++------
include/linux/mlx5/driver.h | 8 ++++++--
2 files changed, 12 insertions(+), 8 deletions(-)
--- a/drivers/infiniband/hw/mlx5/srq.c
+++ b/drivers/infiniband/hw/mlx5/srq.c
@@ -262,11 +262,11 @@ struct ib_srq *mlx5_ib_create_srq(struct
mutex_init(&srq->mutex);
spin_lock_init(&srq->lock);
srq->msrq.max = roundup_pow_of_two(init_attr->attr.max_wr + 1);
- srq->msrq.max_gs = init_attr->attr.max_sge;
+ srq->msrq.max_gs_st = init_attr->attr.max_sge;
desc_size = sizeof(struct mlx5_wqe_srq_next_seg) +
- srq->msrq.max_gs * sizeof(struct mlx5_wqe_data_seg);
- if (desc_size == 0 || srq->msrq.max_gs > desc_size) {
+ srq->msrq.max_gs_st * sizeof(struct mlx5_wqe_data_seg);
+ if (desc_size == 0 || srq->msrq.max_gs_st > desc_size) {
err = -EINVAL;
goto err_srq;
}
@@ -407,7 +407,7 @@ int mlx5_ib_query_srq(struct ib_srq *ibs
srq_attr->srq_limit = out->lwm;
srq_attr->max_wr = srq->msrq.max - 1;
- srq_attr->max_sge = srq->msrq.max_gs;
+ srq_attr->max_sge = srq->msrq.max_gs_st;
out_box:
kfree(out);
@@ -468,7 +468,7 @@ int mlx5_ib_post_srq_recv(struct ib_srq
}
for (nreq = 0; wr; nreq++, wr = wr->next) {
- if (unlikely(wr->num_sge > srq->msrq.max_gs)) {
+ if (unlikely(wr->num_sge > srq->msrq.max_gs_st)) {
err = -EINVAL;
*bad_wr = wr;
break;
@@ -492,7 +492,7 @@ int mlx5_ib_post_srq_recv(struct ib_srq
scat[i].addr = cpu_to_be64(wr->sg_list[i].addr);
}
- if (i < srq->msrq.max_avail_gather) {
+ if (i < srq->msrq.max_avail_gather_st) {
scat[i].byte_count = 0;
scat[i].lkey = cpu_to_be32(MLX5_INVALID_LKEY);
scat[i].addr = 0;
--- a/include/linux/mlx5/driver.h
+++ b/include/linux/mlx5/driver.h
@@ -434,13 +434,17 @@ struct mlx5_core_srq {
struct mlx5_core_rsc_common common; /* must be first */
u32 srqn;
int max;
- size_t max_gs;
- size_t max_avail_gather;
+ int max_gs;
+ int max_avail_gather;
int wqe_shift;
void (*event) (struct mlx5_core_srq *, enum mlx5_event);
atomic_t refcount;
struct completion free;
+#ifndef __GENKSYMS__
+ size_t max_gs_st;
+ size_t max_avail_gather_st;
+#endif
};
struct mlx5_eq_table {