Commit 4a6f18f2 authored by Kees Cook's avatar Kees Cook Committed by Jakub Kicinski
Browse files

net/mlx4_core: Avoid impossible mlx4_db_alloc() order value 



GCC can see that the value range for "order" is capped, but this leads
it to consider that it might be negative, leading to a false positive
warning (with GCC 15 with -Warray-bounds -fdiagnostics-details):

../drivers/net/ethernet/mellanox/mlx4/alloc.c:691:47: error: array subscript -1 is below array bounds of 'long unsigned int *[2]' [-Werror=array-bounds=]
  691 |                 i = find_first_bit(pgdir->bits[o], MLX4_DB_PER_PAGE >> o);
      |                                    ~~~~~~~~~~~^~~
  'mlx4_alloc_db_from_pgdir': events 1-2
  691 |                 i = find_first_bit(pgdir->bits[o], MLX4_DB_PER_PAGE >> o);                        |                     ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      |                     |                         |                                                   |                     |                         (2) out of array bounds here
      |                     (1) when the condition is evaluated to true                             In file included from ../drivers/net/ethernet/mellanox/mlx4/mlx4.h:53,
                 from ../drivers/net/ethernet/mellanox/mlx4/alloc.c:42:
../include/linux/mlx4/device.h:664:33: note: while referencing 'bits'
  664 |         unsigned long          *bits[2];
      |                                 ^~~~

Switch the argument to unsigned int, which removes the compiler needing
to consider negative values.

Signed-off-by: default avatarKees Cook <kees@kernel.org>
Link: https://patch.msgid.link/20250210174504.work.075-kees@kernel.org


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent 0025fa45

drivers/net/ethernet/mellanox/mlx4/alloc.c

+3 −3
Original line number Diff line number Diff line
@@ -660,9 +660,9 @@ static struct mlx4_db_pgdir *mlx4_alloc_db_pgdir(struct device *dma_device) 
}



static int mlx4_alloc_db_from_pgdir(struct mlx4_db_pgdir *pgdir,

				    struct mlx4_db *db, int order)

				    struct mlx4_db *db, unsigned int order)

{

	int o;

	unsigned int o;

	int i;



	for (o = order; o <= 1; ++o) {
@@ -690,7 +690,7 @@ static int mlx4_alloc_db_from_pgdir(struct mlx4_db_pgdir *pgdir, 
	return 0;

}



int mlx4_db_alloc(struct mlx4_dev *dev, struct mlx4_db *db, int order)

int mlx4_db_alloc(struct mlx4_dev *dev, struct mlx4_db *db, unsigned int order)

{

	struct mlx4_priv *priv = mlx4_priv(dev);

	struct mlx4_db_pgdir *pgdir;

include/linux/mlx4/device.h

+1 −1
Original line number Diff line number Diff line
@@ -1135,7 +1135,7 @@ int mlx4_write_mtt(struct mlx4_dev *dev, struct mlx4_mtt *mtt, 
int mlx4_buf_write_mtt(struct mlx4_dev *dev, struct mlx4_mtt *mtt,

		       struct mlx4_buf *buf);



int mlx4_db_alloc(struct mlx4_dev *dev, struct mlx4_db *db, int order);

int mlx4_db_alloc(struct mlx4_dev *dev, struct mlx4_db *db, unsigned int order);

void mlx4_db_free(struct mlx4_dev *dev, struct mlx4_db *db);



int mlx4_alloc_hwq_res(struct mlx4_dev *dev, struct mlx4_hwq_resources *wqres,