Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
RDMA: Properly propagate the number of CQEs as unsigned int
Instead of checking whether the number of CQEs is negative or zero, fix the
.resize_user_cq() declaration to use unsigned int. This better reflects the
expected value range. The sanity check is then handled correctly in ib_uvbers.
Link: https://patch.msgid.link/20260319-resize_cq-cqe-v1-1-b78c6efc1def@nvidia.com
Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev>
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
authored by
Leon Romanovsky
and committed by
Leon Romanovsky
dc76086a
ce68351b
+39
-77
+3
drivers/infiniband/core/uverbs_cmd.c
+3
drivers/infiniband/core/uverbs_cmd.c
+3
-5
drivers/infiniband/hw/bnxt_re/ib_verbs.c
+3
-5
drivers/infiniband/hw/bnxt_re/ib_verbs.c
···
3551
3551
}
3552
3552
}
3553
3553
3554
-
int bnxt_re_resize_cq(struct ib_cq *ibcq, int cqe, struct ib_udata *udata)
3554
+
int bnxt_re_resize_cq(struct ib_cq *ibcq, unsigned int cqe,
3555
+
struct ib_udata *udata)
3555
3556
{
3556
3557
struct bnxt_qplib_sg_info sg_info = {};
3557
3558
struct bnxt_qplib_dpi *orig_dpi = NULL;
···
3578
3577
}
3579
3578
3580
3579
/* Check the requested cq depth out of supported depth */
3581
-
if (cqe < 1 || cqe > dev_attr->max_cq_wqes) {
3582
-
ibdev_err(&rdev->ibdev, "Resize CQ %#x failed - out of range cqe %d",
3583
-
cq->qplib_cq.id, cqe);
3580
+
if (cqe > dev_attr->max_cq_wqes)
3584
3581
return -EINVAL;
3585
-
}
3586
3582
3587
3583
uctx = rdma_udata_to_drv_context(udata, struct bnxt_re_ucontext, ib_uctx);
3588
3584
entries = bnxt_re_init_depth(cqe + 1, uctx);
+2
-1
drivers/infiniband/hw/bnxt_re/ib_verbs.h
+2
-1
drivers/infiniband/hw/bnxt_re/ib_verbs.h
···
255
255
struct uverbs_attr_bundle *attrs);
256
256
int bnxt_re_create_user_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr,
257
257
struct uverbs_attr_bundle *attrs);
258
-
int bnxt_re_resize_cq(struct ib_cq *ibcq, int cqe, struct ib_udata *udata);
258
+
int bnxt_re_resize_cq(struct ib_cq *ibcq, unsigned int cqe,
259
+
struct ib_udata *udata);
259
260
int bnxt_re_destroy_cq(struct ib_cq *cq, struct ib_udata *udata);
260
261
int bnxt_re_poll_cq(struct ib_cq *cq, int num_entries, struct ib_wc *wc);
261
262
int bnxt_re_req_notify_cq(struct ib_cq *cq, enum ib_cq_notify_flags flags);
+1
-1
drivers/infiniband/hw/irdma/verbs.c
+1
-1
drivers/infiniband/hw/irdma/verbs.c
···
2012
2012
* @entries: desired cq size
2013
2013
* @udata: user data
2014
2014
*/
2015
-
static int irdma_resize_cq(struct ib_cq *ibcq, int entries,
2015
+
static int irdma_resize_cq(struct ib_cq *ibcq, unsigned int entries,
2016
2016
struct ib_udata *udata)
2017
2017
{
2018
2018
#define IRDMA_RESIZE_CQ_MIN_REQ_LEN offsetofend(struct irdma_resize_cq_req, user_cq_buffer)
+3
-2
drivers/infiniband/hw/mlx4/cq.c
+3
-2
drivers/infiniband/hw/mlx4/cq.c
···
414
414
++cq->mcq.cons_index;
415
415
}
416
416
417
-
int mlx4_ib_resize_cq(struct ib_cq *ibcq, int entries, struct ib_udata *udata)
417
+
int mlx4_ib_resize_cq(struct ib_cq *ibcq, unsigned int entries,
418
+
struct ib_udata *udata)
418
419
{
419
420
struct mlx4_ib_dev *dev = to_mdev(ibcq->device);
420
421
struct mlx4_ib_cq *cq = to_mcq(ibcq);
···
424
423
int err;
425
424
426
425
mutex_lock(&cq->resize_mutex);
427
-
if (entries < 1 || entries > dev->dev->caps.max_cqes) {
426
+
if (entries > dev->dev->caps.max_cqes) {
428
427
err = -EINVAL;
429
428
goto out;
430
429
}
+2
-1
drivers/infiniband/hw/mlx4/mlx4_ib.h
+2
-1
drivers/infiniband/hw/mlx4/mlx4_ib.h
···
767
767
int mlx4_ib_map_mr_sg(struct ib_mr *ibmr, struct scatterlist *sg, int sg_nents,
768
768
unsigned int *sg_offset);
769
769
int mlx4_ib_modify_cq(struct ib_cq *cq, u16 cq_count, u16 cq_period);
770
-
int mlx4_ib_resize_cq(struct ib_cq *ibcq, int entries, struct ib_udata *udata);
770
+
int mlx4_ib_resize_cq(struct ib_cq *ibcq, unsigned int entries,
771
+
struct ib_udata *udata);
771
772
int mlx4_ib_create_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr,
772
773
struct uverbs_attr_bundle *attrs);
773
774
int mlx4_ib_create_user_cq(struct ib_cq *ibcq,
+3
-7
drivers/infiniband/hw/mlx5/cq.c
+3
-7
drivers/infiniband/hw/mlx5/cq.c
···
1335
1335
return 0;
1336
1336
}
1337
1337
1338
-
int mlx5_ib_resize_cq(struct ib_cq *ibcq, int entries, struct ib_udata *udata)
1338
+
int mlx5_ib_resize_cq(struct ib_cq *ibcq, unsigned int entries,
1339
+
struct ib_udata *udata)
1339
1340
{
1340
1341
struct mlx5_ib_dev *dev = to_mdev(ibcq->device);
1341
1342
struct mlx5_ib_cq *cq = to_mcq(ibcq);
···
1356
1355
return -ENOSYS;
1357
1356
}
1358
1357
1359
-
if (entries < 1 ||
1360
-
entries > (1 << MLX5_CAP_GEN(dev->mdev, log_max_cq_sz))) {
1361
-
mlx5_ib_warn(dev, "wrong entries number %d, max %d\n",
1362
-
entries,
1363
-
1 << MLX5_CAP_GEN(dev->mdev, log_max_cq_sz));
1358
+
if (entries > (1 << MLX5_CAP_GEN(dev->mdev, log_max_cq_sz)))
1364
1359
return -EINVAL;
1365
-
}
1366
1360
1367
1361
entries = roundup_pow_of_two(entries + 1);
1368
1362
if (entries > (1 << MLX5_CAP_GEN(dev->mdev, log_max_cq_sz)) + 1)
+2
-1
drivers/infiniband/hw/mlx5/mlx5_ib.h
+2
-1
drivers/infiniband/hw/mlx5/mlx5_ib.h
···
1309
1309
void mlx5_ib_post_destroy_cq(struct ib_cq *cq);
1310
1310
int mlx5_ib_arm_cq(struct ib_cq *ibcq, enum ib_cq_notify_flags flags);
1311
1311
int mlx5_ib_modify_cq(struct ib_cq *cq, u16 cq_count, u16 cq_period);
1312
-
int mlx5_ib_resize_cq(struct ib_cq *ibcq, int entries, struct ib_udata *udata);
1312
+
int mlx5_ib_resize_cq(struct ib_cq *ibcq, unsigned int entries,
1313
+
struct ib_udata *udata);
1313
1314
struct ib_mr *mlx5_ib_get_dma_mr(struct ib_pd *pd, int acc);
1314
1315
struct ib_mr *mlx5_ib_reg_user_mr(struct ib_pd *pd, u64 start, u64 length,
1315
1316
u64 virt_addr, int access_flags,
+3
-2
drivers/infiniband/hw/mthca/mthca_provider.c
+3
-2
drivers/infiniband/hw/mthca/mthca_provider.c
···
695
695
return 0;
696
696
}
697
697
698
-
static int mthca_resize_cq(struct ib_cq *ibcq, int entries, struct ib_udata *udata)
698
+
static int mthca_resize_cq(struct ib_cq *ibcq, unsigned int entries,
699
+
struct ib_udata *udata)
699
700
{
700
701
struct mthca_dev *dev = to_mdev(ibcq->device);
701
702
struct mthca_cq *cq = to_mcq(ibcq);
···
704
703
u32 lkey;
705
704
int ret;
706
705
707
-
if (entries < 1 || entries > dev->limits.max_cqes)
706
+
if (entries > dev->limits.max_cqes)
708
707
return -EINVAL;
709
708
710
709
mutex_lock(&cq->mutex);
+5
-7
drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
+5
-7
drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
···
1013
1013
return status;
1014
1014
}
1015
1015
1016
-
int ocrdma_resize_cq(struct ib_cq *ibcq, int new_cnt,
1016
+
int ocrdma_resize_cq(struct ib_cq *ibcq, unsigned int new_cnt,
1017
1017
struct ib_udata *udata)
1018
1018
{
1019
-
int status = 0;
1020
1019
struct ocrdma_cq *cq = get_ocrdma_cq(ibcq);
1021
1020
1022
-
if (new_cnt < 1 || new_cnt > cq->max_hw_cqe) {
1023
-
status = -EINVAL;
1024
-
return status;
1025
-
}
1021
+
if (new_cnt > cq->max_hw_cqe)
1022
+
return -EINVAL;
1023
+
1026
1024
ibcq->cqe = new_cnt;
1027
-
return status;
1025
+
return 0;
1028
1026
}
1029
1027
1030
1028
static void ocrdma_flush_cq(struct ocrdma_cq *cq)
+1
-1
drivers/infiniband/hw/ocrdma/ocrdma_verbs.h
+1
-1
drivers/infiniband/hw/ocrdma/ocrdma_verbs.h
···
71
71
72
72
int ocrdma_create_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr,
73
73
struct uverbs_attr_bundle *attrs);
74
-
int ocrdma_resize_cq(struct ib_cq *, int cqe, struct ib_udata *);
74
+
int ocrdma_resize_cq(struct ib_cq *, unsigned int cqe, struct ib_udata *);
75
75
int ocrdma_destroy_cq(struct ib_cq *ibcq, struct ib_udata *udata);
76
76
77
77
int ocrdma_create_qp(struct ib_qp *qp, struct ib_qp_init_attr *attrs,
+2
-2
drivers/infiniband/sw/rdmavt/cq.c
+2
-2
drivers/infiniband/sw/rdmavt/cq.c
···
337
337
*
338
338
* Return: 0 for success.
339
339
*/
340
-
int rvt_resize_cq(struct ib_cq *ibcq, int cqe, struct ib_udata *udata)
340
+
int rvt_resize_cq(struct ib_cq *ibcq, unsigned int cqe, struct ib_udata *udata)
341
341
{
342
342
struct rvt_cq *cq = ibcq_to_rvtcq(ibcq);
343
343
u32 head, tail, n;
···
349
349
struct rvt_k_cq_wc *k_wc = NULL;
350
350
struct rvt_k_cq_wc *old_k_wc = NULL;
351
351
352
-
if (cqe < 1 || cqe > rdi->dparms.props.max_cqe)
352
+
if (cqe > rdi->dparms.props.max_cqe)
353
353
return -EINVAL;
354
354
355
355
/*
+1
-1
drivers/infiniband/sw/rdmavt/cq.h
+1
-1
drivers/infiniband/sw/rdmavt/cq.h
···
13
13
struct uverbs_attr_bundle *attrs);
14
14
int rvt_destroy_cq(struct ib_cq *ibcq, struct ib_udata *udata);
15
15
int rvt_req_notify_cq(struct ib_cq *ibcq, enum ib_cq_notify_flags notify_flags);
16
-
int rvt_resize_cq(struct ib_cq *ibcq, int cqe, struct ib_udata *udata);
16
+
int rvt_resize_cq(struct ib_cq *ibcq, unsigned int cqe, struct ib_udata *udata);
17
17
int rvt_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *entry);
18
18
int rvt_driver_cq_init(void);
19
19
void rvt_cq_exit(void);
-31
drivers/infiniband/sw/rxe/rxe_cq.c
-31
drivers/infiniband/sw/rxe/rxe_cq.c
···
8
8
#include "rxe_loc.h"
9
9
#include "rxe_queue.h"
10
10
11
-
int rxe_cq_chk_attr(struct rxe_dev *rxe, struct rxe_cq *cq,
12
-
int cqe, int comp_vector)
13
-
{
14
-
int count;
15
-
16
-
if (cqe <= 0) {
17
-
rxe_dbg_dev(rxe, "cqe(%d) <= 0\n", cqe);
18
-
goto err1;
19
-
}
20
-
21
-
if (cqe > rxe->attr.max_cqe) {
22
-
rxe_dbg_dev(rxe, "cqe(%d) > max_cqe(%d)\n",
23
-
cqe, rxe->attr.max_cqe);
24
-
goto err1;
25
-
}
26
-
27
-
if (cq) {
28
-
count = queue_count(cq->queue, QUEUE_TYPE_TO_CLIENT);
29
-
if (cqe < count) {
30
-
rxe_dbg_cq(cq, "cqe(%d) < current # elements in queue (%d)\n",
31
-
cqe, count);
32
-
goto err1;
33
-
}
34
-
}
35
-
36
-
return 0;
37
-
38
-
err1:
39
-
return -EINVAL;
40
-
}
41
-
42
11
int rxe_cq_from_init(struct rxe_dev *rxe, struct rxe_cq *cq, int cqe,
43
12
int comp_vector, struct ib_udata *udata,
44
13
struct rxe_create_cq_resp __user *uresp)
-3
drivers/infiniband/sw/rxe/rxe_loc.h
-3
drivers/infiniband/sw/rxe/rxe_loc.h
···
18
18
struct rxe_av *rxe_get_av(struct rxe_pkt_info *pkt, struct rxe_ah **ahp);
19
19
20
20
/* rxe_cq.c */
21
-
int rxe_cq_chk_attr(struct rxe_dev *rxe, struct rxe_cq *cq,
22
-
int cqe, int comp_vector);
23
-
24
21
int rxe_cq_from_init(struct rxe_dev *rxe, struct rxe_cq *cq, int cqe,
25
22
int comp_vector, struct ib_udata *udata,
26
23
struct rxe_create_cq_resp __user *uresp);
+7
-11
drivers/infiniband/sw/rxe/rxe_verbs.c
+7
-11
drivers/infiniband/sw/rxe/rxe_verbs.c
···
1097
1097
goto err_out;
1098
1098
}
1099
1099
1100
-
err = rxe_cq_chk_attr(rxe, NULL, attr->cqe, attr->comp_vector);
1101
-
if (err) {
1102
-
rxe_dbg_dev(rxe, "bad init attributes, err = %d\n", err);
1103
-
goto err_out;
1104
-
}
1100
+
if (attr->cqe > rxe->attr.max_cqe)
1101
+
return -EINVAL;
1105
1102
1106
1103
err = rxe_add_to_pool(&rxe->cq_pool, cq);
1107
1104
if (err) {
···
1124
1127
return err;
1125
1128
}
1126
1129
1127
-
static int rxe_resize_cq(struct ib_cq *ibcq, int cqe, struct ib_udata *udata)
1130
+
static int rxe_resize_cq(struct ib_cq *ibcq, unsigned int cqe,
1131
+
struct ib_udata *udata)
1128
1132
{
1129
1133
struct rxe_cq *cq = to_rcq(ibcq);
1130
1134
struct rxe_dev *rxe = to_rdev(ibcq->device);
···
1141
1143
uresp = udata->outbuf;
1142
1144
}
1143
1145
1144
-
err = rxe_cq_chk_attr(rxe, cq, cqe, 0);
1145
-
if (err) {
1146
-
rxe_dbg_cq(cq, "bad attr, err = %d\n", err);
1147
-
goto err_out;
1148
-
}
1146
+
if (cqe > rxe->attr.max_cqe ||
1147
+
cqe < queue_count(cq->queue, QUEUE_TYPE_TO_CLIENT))
1148
+
return -EINVAL;
1149
1149
1150
1150
err = rxe_cq_resize_queue(cq, cqe, uresp, udata);
1151
1151
if (err) {
+1
-1
include/rdma/ib_verbs.h
+1
-1
include/rdma/ib_verbs.h
···
2634
2634
struct uverbs_attr_bundle *attrs);
2635
2635
int (*modify_cq)(struct ib_cq *cq, u16 cq_count, u16 cq_period);
2636
2636
int (*destroy_cq)(struct ib_cq *cq, struct ib_udata *udata);
2637
-
int (*resize_user_cq)(struct ib_cq *cq, int cqe,
2637
+
int (*resize_user_cq)(struct ib_cq *cq, unsigned int cqe,
2638
2638
struct ib_udata *udata);
2639
2639
/*
2640
2640
* pre_destroy_cq - Prevent a cq from generating any new work