Commit 556f93b9 authored by Qasim Ijaz's avatar Qasim Ijaz Committed by Leon Romanovsky
Browse files

RDMA/mlx5: Handle errors returned from mlx5r_ib_rate() 



In function create_ib_ah() the following line attempts
to left shift the return value of mlx5r_ib_rate() by 4
and store it in the stat_rate_sl member of av:

However the code overlooks the fact that mlx5r_ib_rate()
may return -EINVAL if the rate passed to it is less than
IB_RATE_2_5_GBPS or greater than IB_RATE_800_GBPS.

Because of this, the code may invoke undefined behaviour when
shifting a signed negative value when doing "-EINVAL << 4".

To fix this check for errors before assigning stat_rate_sl and
propagate any error value to the callers.

Fixes: c534ffda ("RDMA/mlx5: Fix AH static rate parsing")
Signed-off-by: default avatarQasim Ijaz <qasdev00@gmail.com>
Link: https://patch.msgid.link/20250304140246.205919-1-qasdev00@gmail.com


Reviewed-by: default avatarPatrisious Haddad <phaddad@nvidia.com>
Signed-off-by: default avatarLeon Romanovsky <leon@kernel.org>
parent e8e6087c

drivers/infiniband/hw/mlx5/ah.c

+9 −5
Original line number Diff line number Diff line
@@ -50,11 +50,12 @@ static __be16 mlx5_ah_get_udp_sport(const struct mlx5_ib_dev *dev, 
	return sport;

}



static void create_ib_ah(struct mlx5_ib_dev *dev, struct mlx5_ib_ah *ah,

static int create_ib_ah(struct mlx5_ib_dev *dev, struct mlx5_ib_ah *ah,

			 struct rdma_ah_init_attr *init_attr)

{

	struct rdma_ah_attr *ah_attr = init_attr->ah_attr;

	enum ib_gid_type gid_type;

	int rate_val;



	if (rdma_ah_get_ah_flags(ah_attr) & IB_AH_GRH) {

		const struct ib_global_route *grh = rdma_ah_read_grh(ah_attr);
@@ -67,8 +68,10 @@ static void create_ib_ah(struct mlx5_ib_dev *dev, struct mlx5_ib_ah *ah, 
		ah->av.tclass = grh->traffic_class;

	}



	ah->av.stat_rate_sl =

		(mlx5r_ib_rate(dev, rdma_ah_get_static_rate(ah_attr)) << 4);

	rate_val = mlx5r_ib_rate(dev, rdma_ah_get_static_rate(ah_attr));

	if (rate_val < 0)

		return rate_val;

	ah->av.stat_rate_sl = rate_val << 4;



	if (ah_attr->type == RDMA_AH_ATTR_TYPE_ROCE) {

		if (init_attr->xmit_slave)
@@ -89,6 +92,8 @@ static void create_ib_ah(struct mlx5_ib_dev *dev, struct mlx5_ib_ah *ah, 
		ah->av.fl_mlid = rdma_ah_get_path_bits(ah_attr) & 0x7f;

		ah->av.stat_rate_sl |= (rdma_ah_get_sl(ah_attr) & 0xf);

	}



	return 0;

}



int mlx5_ib_create_ah(struct ib_ah *ibah, struct rdma_ah_init_attr *init_attr,
@@ -121,8 +126,7 @@ int mlx5_ib_create_ah(struct ib_ah *ibah, struct rdma_ah_init_attr *init_attr, 
			return err;

	}



	create_ib_ah(dev, ah, init_attr);

	return 0;

	return create_ib_ah(dev, ah, init_attr);

}



int mlx5_ib_query_ah(struct ib_ah *ibah, struct rdma_ah_attr *ah_attr)