Re: [PATCH] RDMA/hns: Fix arithmetic overflow in hns_roce_v2_set_hem()

[David Laight]

On Tue, 7 Jul 2026 17:09:38 +0300
<Alexander.Chesnokov@xxxxxxxxxxxxx> wrote:

> From: Alexander Chesnokov <Alexander.Chesnokov@xxxxxxxxxxxxx>
> 
> If hop_num is 2 or 1, then the expressions like
> i * chunk_ba_num + j are computed in 32-bit
> arithmetic before being assigned to a u64 index field,
> which can lead to overflow.
> 
> Cast the first operand to u64 to ensure the arithmetic
> is performed in 64-bit.

If the values can be 64bit it would be better to just make i/j/k u64.

	David

> 
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
> 
> Fixes: a81fba28136d ("RDMA/hns: Configure BT BA and BT attribute for the contexts in hip08")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Alexander Chesnokov <Alexander.Chesnokov@xxxxxxxxxxxxx>
> ---
>  drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
> index 1c180a6b1c07..b62513b4db09 100644
> --- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
> +++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
> @@ -4257,11 +4257,11 @@ static int hns_roce_v2_set_hem(struct hns_roce_dev *hr_dev,
>  	chunk_ba_num = mhop.bt_chunk_size / 8;
>  
>  	if (hop_num == 2) {
> -		hem_idx = i * chunk_ba_num * chunk_ba_num + j * chunk_ba_num +
> +		hem_idx = (u64)i * chunk_ba_num * chunk_ba_num + (u64)j * chunk_ba_num +
>  			  k;
> -		l1_idx = i * chunk_ba_num + j;
> +		l1_idx = (u64)i * chunk_ba_num + j;
>  	} else if (hop_num == 1) {
> -		hem_idx = i * chunk_ba_num + j;
> +		hem_idx = (u64)i * chunk_ba_num + j;
>  	} else if (hop_num == HNS_ROCE_HOP_NUM_0) {
>  		hem_idx = i;
>  	}