Skip to contentSkip to conversation

mlx5: shift wrapping bug in mlx5_ib_get_buf_offset()

PATCH In review Dan Carpenter 2 participants 2 messages Nov 8, 2013 – Nov 10, 2013

Subsystems (3)
Kernel janitors InfiniBand Mellanox MLX5 IB driver
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 mlx5: shift wrapping bug in mlx5_ib_get_buf_offset()

"page_size" is declared as u64 but the (1 << page_shift) shift will wrap at 32 bits.

Fixes e126ba97dba9 ('mlx5: Add driver for Mellanox Connect-IB adapters')
Signed-off-by Dan Carpenter <[email protected]>
drivers/infiniband/hw/mlx5/mem.c +1 -1
index 3a53228..3020ec2 100644
@@ -148,7 +148,7 @@ int mlx5_ib_get_buf_offset(u64 addr, int page_shift, u32 *offset)
 	u64 off_mask;
 	u64 buf_off;
 
-	page_size = 1 << page_shift;
+	page_size = 1ULL << page_shift;
 	page_mask = page_size - 1;
 	buf_off = addr & page_mask;
 	off_size = page_size >> 6;
#1 lore raw
Quoted 2 lines · Dan Carpenter

"page_size" is declared as u64 but the (1 << page_shift) shift will wrap at 32 bits.

I hope to live when this happnes :-)
I prefer to be explicit and use:

        page_size = (u64)1 << page_shift;
Quoted 21 lines
Fixes e126ba97dba9 ('mlx5: Add driver for Mellanox Connect-IB adapters')
Signed-off-by Dan Carpenter <[email protected]>
drivers/infiniband/hw/mlx5/mem.c +1 -2
index 3a53228..3020ec2 100644
@@ -148,7 +148,7 @@ int mlx5_ib_get_buf_offset(u64 addr, int page_shift, u32 *offset)
 	u64 off_mask;
 	u64 buf_off;
 
-	page_size = 1 << page_shift;
+	page_size = 1ULL << page_shift;
 	page_mask = page_size - 1;
 	buf_off = addr & page_mask;
 	off_size = page_size >> 6;
--

To unsubscribe from this list: send the line "unsubscribe linux-rdma" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html