RDMA: Change capability fields in ib_device_attr from int to u32

PATCH Superseded Erni Sri Satya Vennela 4 participants 9 messages Jun 1 – Jun 6

Subsystems (19)

Networking Network drivers NFS client NFS server +15 more subsystems

lore

Share & tools

lore

Erni Sri Satya Vennela

author

2026-06-01 09:26 UTC #0 lore raw

PATCH v6 1/1 RDMA: Change capability fields in ib_device_attr from int to u32

The capability counter fields in struct ib_device_attr are declared as signed int, but these values are inherently non-negative. Drivers maintain their cached caps as u32 and assign them directly into these int fields; if a cap exceeds INT_MAX the implicit narrowing yields a negative value visible to the IB core.

Change the signed int capability fields to u32 to match the underlying nature of the data. Also update consumers across the IB core, ULPs, NVMe-oF target, RDS, and NFS/RDMA so the new u32 values are not forced back through signed int or u8 via min()/min_t() or narrowing local variables.

Signed-off-by Erni Sri Satya Vennela <[email protected]>

---
Changes in v6:
* Fix subject prefix: net-next -> rdma-next.
Changes in v5:
* Add U8_MAX clamps in iser_verbs, nvme/host, nvme/target, isert, rds/ib_cm, smbdirect/connect and smbdirect/accept where u32 capability fields were directly narrowed into u8 rdma_conn_param fields without clamping
* Guard the inline_sge_count calculation in nvmet_rdma_find_get_device() to prevent u32 underflow when both max_sge_rd and max_recv_sge are zero
* Expand type migration to 9 additional fields (max_mw, max_raw_ethy_qp, max_mcast_grp, max_mcast_qp_attach, max_total_mcast_qp_attach, max_ah, max_srq, max_srq_wr, max_srq_sge)
* Fix min_t(int,...) in svc_rdma_transport; min_t(u32,...) in ipoib, srpt, nvme/target, rds/ib, rtrs-clt, rtrs-srv, xprtrdma/verbs
* Fix frwr_ops.c u32 underflow guard (reorder check before subtraction)
* Change sc_max_send_sges to unsigned int, inline_sge_count to u32
* Fix %d -> %u in rxe_qp, rxe_srq, ipoib_cm, ib_isert, svc_rdma_transport
* Update commit message.
Changes in v4:
* Drop clamping the values in mana_ib_query_device, instead update the props values from int to u32.
Changes in v3:
* Drop clamping from mana_ib_gd_query_adapter_caps(). The internal u32 caps cache does not need to be clamped.
* Move all clamping exclusively to mana_ib_query_device(), which is the only place the cached u32 values are narrowed into the signed int fields of struct ib_device_attr.
* Reframe commit message: this is a u32-to-int type boundary fix, not a CVM/untrusted-hardware hardening patch.
Changes in v2:
* Update patch title.

---
 drivers/infiniband/hw/qedr/verbs.c       |  4 +--
 drivers/infiniband/sw/rxe/rxe_qp.c       | 16 ++++-----
 drivers/infiniband/sw/rxe/rxe_srq.c      | 16 ++++-----
 drivers/infiniband/ulp/ipoib/ipoib_cm.c  |  7 ++--
 drivers/infiniband/ulp/iser/iser_verbs.c |  2 +-
 drivers/infiniband/ulp/isert/ib_isert.c  |  8 ++---
 drivers/infiniband/ulp/rtrs/rtrs-clt.c   | 12 +++----
 drivers/infiniband/ulp/rtrs/rtrs-srv.c   |  6 ++--
 drivers/infiniband/ulp/srp/ib_srp.c      |  2 +-
 drivers/infiniband/ulp/srpt/ib_srpt.c    |  6 ++--
 drivers/nvme/host/rdma.c                 |  3 +-
 drivers/nvme/target/rdma.c               | 17 +++++-----
 fs/smb/smbdirect/accept.c                |  4 +--
 fs/smb/smbdirect/connect.c               |  4 +--
 include/linux/sunrpc/svc_rdma.h          |  2 +-
 include/rdma/ib_verbs.h                  | 42 ++++++++++++------------
 net/rds/ib.c                             |  4 +--
 net/rds/ib_cm.c                          |  6 ++--
 net/sunrpc/xprtrdma/frwr_ops.c           |  7 ++--
 net/sunrpc/xprtrdma/svc_rdma_transport.c |  4 +--
 net/sunrpc/xprtrdma/verbs.c              |  2 +-
 21 files changed, 90 insertions(+), 84 deletions(-)

drivers/infiniband/hw/qedr/verbs.c +2 -2

index 679aa6f3a63b..64ea72529682 100644
@@ -151,8 +151,8 @@ int qedr_query_device(struct ib_device *ibdev,
 	attr->max_qp_init_rd_atom =
 	    1 << (fls(qattr->max_qp_req_rd_atomic_resc) - 1);
 	attr->max_qp_rd_atom =
-	    min(1 << (fls(qattr->max_qp_resp_rd_atomic_resc) - 1),
-		attr->max_qp_init_rd_atom);
+	    min_t(u32, 1 << (fls(qattr->max_qp_resp_rd_atomic_resc) - 1),
+		  attr->max_qp_init_rd_atom);
 
 	attr->max_srq = qattr->max_srq;
 	attr->max_srq_sge = qattr->max_srq_sge;

drivers/infiniband/sw/rxe/rxe_qp.c +8 -8

index f3dff1aea96a..b25bbf6606f8 100644
@@ -67,27 +67,27 @@ static int rxe_qp_chk_cap(struct rxe_dev *rxe, struct ib_qp_cap *cap,
 			  int has_srq)
 {
 	if (cap->max_send_wr > rxe->attr.max_qp_wr) {
-		rxe_dbg_dev(rxe, "invalid send wr = %u > %d\n",
-			 cap->max_send_wr, rxe->attr.max_qp_wr);
+		rxe_dbg_dev(rxe, "invalid send wr = %u > %u\n",
+			    cap->max_send_wr, rxe->attr.max_qp_wr);
 		goto err1;
 	}
 
 	if (cap->max_send_sge > rxe->attr.max_send_sge) {
-		rxe_dbg_dev(rxe, "invalid send sge = %u > %d\n",
-			 cap->max_send_sge, rxe->attr.max_send_sge);
+		rxe_dbg_dev(rxe, "invalid send sge = %u > %u\n",
+			    cap->max_send_sge, rxe->attr.max_send_sge);
 		goto err1;
 	}
 
 	if (!has_srq) {
 		if (cap->max_recv_wr > rxe->attr.max_qp_wr) {
-			rxe_dbg_dev(rxe, "invalid recv wr = %u > %d\n",
-				 cap->max_recv_wr, rxe->attr.max_qp_wr);
+			rxe_dbg_dev(rxe, "invalid recv wr = %u > %u\n",
+				    cap->max_recv_wr, rxe->attr.max_qp_wr);
 			goto err1;
 		}
 
 		if (cap->max_recv_sge > rxe->attr.max_recv_sge) {
-			rxe_dbg_dev(rxe, "invalid recv sge = %u > %d\n",
-				 cap->max_recv_sge, rxe->attr.max_recv_sge);
+			rxe_dbg_dev(rxe, "invalid recv sge = %u > %u\n",
+				    cap->max_recv_sge, rxe->attr.max_recv_sge);
 			goto err1;
 		}
 	}

drivers/infiniband/sw/rxe/rxe_srq.c +8 -8

index c9a7cd38953d..74904a6fdf2b 100644
@@ -13,8 +13,8 @@ int rxe_srq_chk_init(struct rxe_dev *rxe, struct ib_srq_init_attr *init)
 	struct ib_srq_attr *attr = &init->attr;
 
 	if (attr->max_wr > rxe->attr.max_srq_wr) {
-		rxe_dbg_dev(rxe, "max_wr(%d) > max_srq_wr(%d)\n",
-			attr->max_wr, rxe->attr.max_srq_wr);
+		rxe_dbg_dev(rxe, "max_wr(%u) > max_srq_wr(%u)\n",
+			    attr->max_wr, rxe->attr.max_srq_wr);
 		goto err1;
 	}

@@ -27,8 +27,8 @@ int rxe_srq_chk_init(struct rxe_dev *rxe, struct ib_srq_init_attr *init)
 		attr->max_wr = RXE_MIN_SRQ_WR;
 
 	if (attr->max_sge > rxe->attr.max_srq_sge) {
-		rxe_dbg_dev(rxe, "max_sge(%d) > max_srq_sge(%d)\n",
-			attr->max_sge, rxe->attr.max_srq_sge);
+		rxe_dbg_dev(rxe, "max_sge(%u) > max_srq_sge(%u)\n",
+			    attr->max_sge, rxe->attr.max_srq_sge);
 		goto err1;
 	}

@@ -107,8 +107,8 @@ int rxe_srq_chk_attr(struct rxe_dev *rxe, struct rxe_srq *srq,
 
 	if (mask & IB_SRQ_MAX_WR) {
 		if (attr->max_wr > rxe->attr.max_srq_wr) {
-			rxe_dbg_srq(srq, "max_wr(%d) > max_srq_wr(%d)\n",
-				attr->max_wr, rxe->attr.max_srq_wr);
+			rxe_dbg_srq(srq, "max_wr(%u) > max_srq_wr(%u)\n",
+				    attr->max_wr, rxe->attr.max_srq_wr);
 			goto err1;
 		}

@@ -129,8 +129,8 @@ int rxe_srq_chk_attr(struct rxe_dev *rxe, struct rxe_srq *srq,
 
 	if (mask & IB_SRQ_LIMIT) {
 		if (attr->srq_limit > rxe->attr.max_srq_wr) {
-			rxe_dbg_srq(srq, "srq_limit(%d) > max_srq_wr(%d)\n",
-				attr->srq_limit, rxe->attr.max_srq_wr);
+			rxe_dbg_srq(srq, "srq_limit(%u) > max_srq_wr(%u)\n",
+				    attr->srq_limit, rxe->attr.max_srq_wr);
 			goto err1;
 		}

drivers/infiniband/ulp/ipoib/ipoib_cm.c +4 -3

index 57fec88a1629..58606501bcd7 100644
@@ -1582,7 +1582,8 @@ static void ipoib_cm_create_srq(struct net_device *dev, int max_sge)
 int ipoib_cm_dev_init(struct net_device *dev)
 {
 	struct ipoib_dev_priv *priv = ipoib_priv(dev);
-	int max_srq_sge, i;
+	int i;
+	u32 max_srq_sge;
 	u8 addr;
 
 	INIT_LIST_HEAD(&priv->cm.passive_ids);

@@ -1600,9 +1601,9 @@ int ipoib_cm_dev_init(struct net_device *dev)
 
 	skb_queue_head_init(&priv->cm.skb_queue);
 
-	ipoib_dbg(priv, "max_srq_sge=%d\n", priv->ca->attrs.max_srq_sge);
+	ipoib_dbg(priv, "max_srq_sge=%u\n", priv->ca->attrs.max_srq_sge);
 
-	max_srq_sge = min_t(int, IPOIB_CM_RX_SG, priv->ca->attrs.max_srq_sge);
+	max_srq_sge = min_t(u32, IPOIB_CM_RX_SG, priv->ca->attrs.max_srq_sge);
 	ipoib_cm_create_srq(dev, max_srq_sge);
 	if (ipoib_cm_has_srq(dev)) {
 		priv->cm.max_cm_mtu = max_srq_sge * PAGE_SIZE - 0x10;

drivers/infiniband/ulp/iser/iser_verbs.c +1 -1

index f03b3bb3c0c4..a9a366fb3a34 100644
@@ -589,7 +589,7 @@ static void iser_route_handler(struct rdma_cm_id *cma_id)
 		goto failure;
 
 	memset(&conn_param, 0, sizeof conn_param);
-	conn_param.responder_resources = ib_dev->attrs.max_qp_rd_atom;
+	conn_param.responder_resources = min_t(u32, U8_MAX, ib_dev->attrs.max_qp_rd_atom);
 	conn_param.initiator_depth = 1;
 	conn_param.retry_count = 7;
 	conn_param.rnr_retry_count = 6;

drivers/infiniband/ulp/isert/ib_isert.c +4 -4

index 348005e71891..3bebf99f600c 100644
@@ -214,9 +214,9 @@ isert_create_device_ib_res(struct isert_device *device)
 	struct ib_device *ib_dev = device->ib_device;
 	int ret;
 
-	isert_dbg("devattr->max_send_sge: %d devattr->max_recv_sge %d\n",
+	isert_dbg("devattr->max_send_sge: %u devattr->max_recv_sge %u\n",
 		  ib_dev->attrs.max_send_sge, ib_dev->attrs.max_recv_sge);
-	isert_dbg("devattr->max_sge_rd: %d\n", ib_dev->attrs.max_sge_rd);
+	isert_dbg("devattr->max_sge_rd: %u\n", ib_dev->attrs.max_sge_rd);
 
 	device->pd = ib_alloc_pd(ib_dev, 0);
 	if (IS_ERR(device->pd)) {

@@ -381,8 +381,8 @@ isert_set_nego_params(struct isert_conn *isert_conn,
 	struct ib_device_attr *attr = &isert_conn->device->ib_device->attrs;
 
 	/* Set max inflight RDMA READ requests */
-	isert_conn->initiator_depth = min_t(u8, param->initiator_depth,
-				attr->max_qp_init_rd_atom);
+	isert_conn->initiator_depth = min_t(u32, param->initiator_depth,
+					    attr->max_qp_init_rd_atom);
 	isert_dbg("Using initiator_depth: %u\n", isert_conn->initiator_depth);
 
 	if (param->private_data) {

drivers/infiniband/ulp/rtrs/rtrs-clt.c +6 -6

index e351552733df..5245b4b7fb4e 100644
@@ -1682,7 +1682,7 @@ static int create_con_cq_qp(struct rtrs_clt_con *con)
 		 * in case qp gets into error state.
 		 */
 		max_send_wr =
-			min_t(int, wr_limit, SERVICE_CON_QUEUE_DEPTH * 2 + 2);
+			min_t(u32, wr_limit, SERVICE_CON_QUEUE_DEPTH * 2 + 2);
 		max_recv_wr = max_send_wr;
 	} else {
 		/*

@@ -1698,11 +1698,11 @@ static int create_con_cq_qp(struct rtrs_clt_con *con)
 		wr_limit = clt_path->s.dev->ib_dev->attrs.max_qp_wr;
 		/* Shared between connections */
 		clt_path->s.dev_ref++;
-		max_send_wr = min_t(int, wr_limit,
-			      /* QD * (REQ + RSP + FR REGS or INVS) + drain */
-			      clt_path->queue_depth * 4 + 1);
-		max_recv_wr = min_t(int, wr_limit,
-			      clt_path->queue_depth * 3 + 1);
+		max_send_wr = min_t(u32, wr_limit,
+				    /* QD * (REQ + RSP + FR REGS or INVS) + drain */
+				    clt_path->queue_depth * 4 + 1);
+		max_recv_wr = min_t(u32, wr_limit,
+				    clt_path->queue_depth * 3 + 1);
 		max_send_sge = 2;
 	}
 	atomic_set(&con->c.sq_wr_avail, max_send_wr);

drivers/infiniband/ulp/rtrs/rtrs-srv.c +3 -3

index 6482ad859bd1..852213365ecd 100644
@@ -1731,7 +1731,7 @@ static int create_con(struct rtrs_srv_path *srv_path,
 		 * All receive and all send (each requiring invalidate)
 		 * + 2 for drain and heartbeat
 		 */
-		max_send_wr = min_t(int, wr_limit,
+		max_send_wr = min_t(u32, wr_limit,
 				    SERVICE_CON_QUEUE_DEPTH * 2 + 2);
 		max_recv_wr = max_send_wr;
 		s->signal_interval = min_not_zero(srv->queue_depth,

@@ -1740,11 +1740,11 @@ static int create_con(struct rtrs_srv_path *srv_path,
 		/* when always_invlaidate enalbed, we need linv+rinv+mr+imm */
 		if (always_invalidate)
 			max_send_wr =
-				min_t(int, wr_limit,
+				min_t(u32, wr_limit,
 				      srv->queue_depth * (1 + 4) + 1);
 		else
 			max_send_wr =
-				min_t(int, wr_limit,
+				min_t(u32, wr_limit,
 				      srv->queue_depth * (1 + 2) + 1);
 
 		max_recv_wr = srv->queue_depth + 1;

drivers/infiniband/ulp/srp/ib_srp.c +1 -1

index b58868e1cf11..dc30d069ab3d 100644
@@ -557,7 +557,7 @@ static int srp_create_ch_ib(struct srp_rdma_ch *ch)
 	init_attr->cap.max_send_wr     = m * target->queue_size;
 	init_attr->cap.max_recv_wr     = target->queue_size + 1;
 	init_attr->cap.max_recv_sge    = 1;
-	init_attr->cap.max_send_sge    = min(SRP_MAX_SGE, attr->max_send_sge);
+	init_attr->cap.max_send_sge    = min_t(u32, SRP_MAX_SGE, attr->max_send_sge);
 	init_attr->sq_sig_type         = IB_SIGNAL_REQ_WR;
 	init_attr->qp_type             = IB_QPT_RC;
 	init_attr->send_cq             = send_cq;

drivers/infiniband/ulp/srpt/ib_srpt.c +3 -3

index 9aec5d80117f..2ffa4f54cd4e 100644
@@ -1884,7 +1884,7 @@ static int srpt_create_ch_ib(struct srpt_rdma_ch *ch)
 	 * both both, as RDMA contexts will also post completions for the
 	 * RDMA READ case.
 	 */
-	qp_init->cap.max_send_wr = min(sq_size / 2, attrs->max_qp_wr);
+	qp_init->cap.max_send_wr = min_t(u32, sq_size / 2, attrs->max_qp_wr);
 	qp_init->cap.max_rdma_ctxs = sq_size / 2;
 	qp_init->cap.max_send_sge = attrs->max_send_sge;
 	qp_init->cap.max_recv_sge = 1;

@@ -2298,7 +2298,7 @@ static int srpt_cm_req_recv(struct srpt_device *const sdev,
 	 * depth to avoid that the initiator driver has to report QUEUE_FULL
 	 * to the SCSI mid-layer.
 	 */
-	ch->rq_size = min(MAX_SRPT_RQ_SIZE, sdev->device->attrs.max_qp_wr);
+	ch->rq_size = min_t(u32, MAX_SRPT_RQ_SIZE, sdev->device->attrs.max_qp_wr);
 	spin_lock_init(&ch->spinlock);
 	ch->state = CH_CONNECTING;
 	INIT_LIST_HEAD(&ch->cmd_wait_list);

@@ -3225,7 +3225,7 @@ static int srpt_add_one(struct ib_device *device)
 
 	sdev->lkey = sdev->pd->local_dma_lkey;
 
-	sdev->srq_size = min(srpt_srq_size, sdev->device->attrs.max_srq_wr);
+	sdev->srq_size = min_t(u32, srpt_srq_size, sdev->device->attrs.max_srq_wr);
 
 	srpt_use_srq(sdev, sdev->port[0].port_attrib.use_srq);

drivers/nvme/host/rdma.c +2 -1

index f77c960f7632..f45d79816bc8 100644
@@ -1845,7 +1845,8 @@ static int nvme_rdma_route_resolved(struct nvme_rdma_queue *queue)
 	param.qp_num = queue->qp->qp_num;
 	param.flow_control = 1;
 
-	param.responder_resources = queue->device->dev->attrs.max_qp_rd_atom;
+	param.responder_resources = min_t(u32, U8_MAX,
+					  queue->device->dev->attrs.max_qp_rd_atom);
 	/* maximum retry count */
 	param.retry_count = 7;
 	param.rnr_retry_count = 7;

drivers/nvme/target/rdma.c +9 -8

index e6e2c3f9afdf..fd6923198ec1 100644
@@ -1149,10 +1149,10 @@ static int nvmet_rdma_init_srqs(struct nvmet_rdma_device *ndev)
 		return 0;
 	}
 
-	ndev->srq_size = min(ndev->device->attrs.max_srq_wr,
-			     nvmet_rdma_srq_size);
-	ndev->srq_count = min(ndev->device->num_comp_vectors,
-			      ndev->device->attrs.max_srq);
+	ndev->srq_size = min_t(u32, ndev->device->attrs.max_srq_wr,
+			       nvmet_rdma_srq_size);
+	ndev->srq_count = min_t(u32, ndev->device->num_comp_vectors,
+				ndev->device->attrs.max_srq);
 
 	ndev->srqs = kzalloc_objs(*ndev->srqs, ndev->srq_count);
 	if (!ndev->srqs)

@@ -1197,7 +1197,7 @@ nvmet_rdma_find_get_device(struct rdma_cm_id *cm_id)
 	struct nvmet_port *nport = port->nport;
 	struct nvmet_rdma_device *ndev;
 	int inline_page_count;
-	int inline_sge_count;
+	u32 inline_sge_count;
 	int ret;
 
 	mutex_lock(&device_list_mutex);

@@ -1213,7 +1213,8 @@ nvmet_rdma_find_get_device(struct rdma_cm_id *cm_id)
 
 	inline_page_count = num_pages(nport->inline_data_size);
 	inline_sge_count = max(cm_id->device->attrs.max_sge_rd,
-				cm_id->device->attrs.max_recv_sge) - 1;
+				cm_id->device->attrs.max_recv_sge);
+	inline_sge_count = inline_sge_count ? inline_sge_count - 1 : 0;
 	if (inline_page_count > inline_sge_count) {
 		pr_warn("inline_data_size %d cannot be supported by device %s. Reducing to %lu.\n",
 			nport->inline_data_size, cm_id->device->name,

@@ -1553,8 +1554,8 @@ static int nvmet_rdma_cm_accept(struct rdma_cm_id *cm_id,
 
 	param.rnr_retry_count = 7;
 	param.flow_control = 1;
-	param.initiator_depth = min_t(u8, p->initiator_depth,
-		queue->dev->device->attrs.max_qp_init_rd_atom);
+	param.initiator_depth = (u8)min_t(u32, p->initiator_depth,
+		min_t(u32, U8_MAX, queue->dev->device->attrs.max_qp_init_rd_atom));
 	param.private_data = &priv;
 	param.private_data_len = sizeof(priv);
 	priv.recfmt = cpu_to_le16(NVME_RDMA_CM_FMT_1_0);

fs/smb/smbdirect/accept.c +2 -2

index 529740005838..890ce6985f4d 100644
@@ -32,8 +32,8 @@ int smbdirect_accept_connect_request(struct smbdirect_socket *sc,
 	/*
 	 * First set what the we as server are able to support
 	 */
-	sp->initiator_depth = min_t(u8, sp->initiator_depth,
-				    sc->ib.dev->attrs.max_qp_rd_atom);
+	sp->initiator_depth = min_t(u32, sp->initiator_depth,
+				    min_t(u32, U8_MAX, sc->ib.dev->attrs.max_qp_rd_atom));
 
 	peer_initiator_depth = param->initiator_depth;
 	peer_responder_resources = param->responder_resources;

fs/smb/smbdirect/connect.c +2 -2

index cd726b399afe..1a38772bb08c 100644
@@ -182,8 +182,8 @@ static int smbdirect_connect_rdma_connect(struct smbdirect_socket *sc)
 	if (sc->ib.dev->attrs.kernel_cap_flags & IBK_SG_GAPS_REG)
 		sc->mr_io.type = IB_MR_TYPE_SG_GAPS;
 
-	sp->responder_resources = min_t(u8, sp->responder_resources,
-					sc->ib.dev->attrs.max_qp_rd_atom);
+	sp->responder_resources = min_t(u32, sp->responder_resources,
+					min_t(u32, U8_MAX, sc->ib.dev->attrs.max_qp_rd_atom));
 	smbdirect_log_rdma_mr(sc, SMBDIRECT_LOG_INFO,
 		"responder_resources=%d\n",
 		sp->responder_resources);

include/linux/sunrpc/svc_rdma.h +1 -1

index df6e08aaad57..05935e9f5530 100644
@@ -79,7 +79,7 @@ struct svcxprt_rdma {
 	struct list_head     sc_accept_q;	/* Conn. waiting accept */
 	struct rpcrdma_notification sc_rn;	/* removal notification */
 	int		     sc_ord;		/* RDMA read limit */
-	int                  sc_max_send_sges;
+	unsigned int         sc_max_send_sges;
 	bool		     sc_snd_w_inv;	/* OK to use Send With Invalidate */
 
 	atomic_t             sc_sq_avail;	/* SQEs ready to be consumed */

include/rdma/ib_verbs.h +21 ~~-21~~

57 lines not on this page · raw message

net/rds/ib.c +2 -2

index 39f87272e071..d493bdd2d3e9 100644
@@ -151,7 +151,7 @@ static int rds_ib_add_one(struct ib_device *device)
 	INIT_LIST_HEAD(&rds_ibdev->conn_list);
 
 	rds_ibdev->max_wrs = device->attrs.max_qp_wr;
-	rds_ibdev->max_sge = min(device->attrs.max_send_sge, RDS_IB_MAX_SGE);
+	rds_ibdev->max_sge = min_t(u32, device->attrs.max_send_sge, RDS_IB_MAX_SGE);
 
 	rds_ibdev->odp_capable =
 		!!(device->attrs.kernel_cap_flags &

@@ -204,7 +204,7 @@ static int rds_ib_add_one(struct ib_device *device)
 		goto put_dev;
 	}
 
-	rdsdebug("RDS/IB: max_mr = %d, max_wrs = %d, max_sge = %d, max_1m_mrs = %d, max_8k_mrs = %d\n",
+	rdsdebug("RDS/IB: max_mr = %u, max_wrs = %d, max_sge = %d, max_1m_mrs = %d, max_8k_mrs = %d\n",
 		 device->attrs.max_mr, rds_ibdev->max_wrs, rds_ibdev->max_sge,
 		 rds_ibdev->max_1m_mrs, rds_ibdev->max_8k_mrs);

net/rds/ib_cm.c +4 -2

index 0c64c504f79d..50292dc9884f 100644
@@ -174,9 +174,11 @@ static void rds_ib_cm_fill_conn_param(struct rds_connection *conn,
 	memset(conn_param, 0, sizeof(struct rdma_conn_param));
 
 	conn_param->responder_resources =
-		min_t(u32, rds_ibdev->max_responder_resources, max_responder_resources);
+		(u8)min3(rds_ibdev->max_responder_resources,
+			 max_responder_resources, (unsigned int)U8_MAX);
 	conn_param->initiator_depth =
-		min_t(u32, rds_ibdev->max_initiator_depth, max_initiator_depth);
+		(u8)min3(rds_ibdev->max_initiator_depth,
+			 max_initiator_depth, (unsigned int)U8_MAX);
 	conn_param->retry_count = min_t(unsigned int, rds_ib_retry_count, 7);
 	conn_param->rnr_retry_count = 7;

net/sunrpc/xprtrdma/frwr_ops.c +4 -3

index 7f79a0a2601e..19f7088a7b54 100644
@@ -172,7 +172,8 @@ int frwr_mr_init(struct rpcrdma_xprt *r_xprt, struct rpcrdma_mr *mr)
 int frwr_query_device(struct rpcrdma_ep *ep, const struct ib_device *device)
 {
 	const struct ib_device_attr *attrs = &device->attrs;
-	int max_qp_wr, depth, delta;
+	u32 max_qp_wr;
+	int depth, delta;
 	unsigned int max_sge;
 
 	if (!(attrs->device_cap_flags & IB_DEVICE_MEM_MGT_EXTENSIONS) ||

@@ -229,10 +230,10 @@ int frwr_query_device(struct rpcrdma_ep *ep, const struct ib_device *device)
 	}
 
 	max_qp_wr = attrs->max_qp_wr;
+	if (max_qp_wr < RPCRDMA_BACKWARD_WRS + 1 + RPCRDMA_MIN_SLOT_TABLE)
+		return -ENOMEM;
 	max_qp_wr -= RPCRDMA_BACKWARD_WRS;
 	max_qp_wr -= 1;
-	if (max_qp_wr < RPCRDMA_MIN_SLOT_TABLE)
-		return -ENOMEM;
 	if (ep->re_max_requests > max_qp_wr)
 		ep->re_max_requests = max_qp_wr;
 	ep->re_attr.cap.max_send_wr = ep->re_max_requests * depth;

net/sunrpc/xprtrdma/svc_rdma_transport.c +2 -2

index f18bc60d9f4f..a2ff2752a591 100644
@@ -544,7 +544,7 @@ static struct svc_xprt *svc_rdma_accept(struct svc_xprt *xprt)
 	set_bit(RDMAXPRT_CONN_PENDING, &newxprt->sc_flags);
 	memset(&conn_param, 0, sizeof conn_param);
 	conn_param.responder_resources = 0;
-	conn_param.initiator_depth = min_t(int, newxprt->sc_ord,
+	conn_param.initiator_depth = min_t(u32, newxprt->sc_ord,
 					   dev->attrs.max_qp_init_rd_atom);
 	if (!conn_param.initiator_depth) {
 		ret = -EINVAL;

@@ -570,7 +570,7 @@ static struct svc_xprt *svc_rdma_accept(struct svc_xprt *xprt)
 		dprintk("    local address   : %pIS:%u\n", sap, rpc_get_port(sap));
 		sap = (struct sockaddr *)&newxprt->sc_cm_id->route.addr.dst_addr;
 		dprintk("    remote address  : %pIS:%u\n", sap, rpc_get_port(sap));
-		dprintk("    max_sge         : %d\n", newxprt->sc_max_send_sges);
+		dprintk("    max_sge         : %u\n", newxprt->sc_max_send_sges);
 		dprintk("    sq_depth        : %d\n", newxprt->sc_sq_depth);
 		dprintk("    rdma_rw_ctxs    : %d\n", ctxts);
 		dprintk("    max_requests    : %d\n", newxprt->sc_max_requests);

net/sunrpc/xprtrdma/verbs.c +1 -1

index aecf9c0a153f..236ec233c579 100644
@@ -453,7 +453,7 @@ static int rpcrdma_ep_create(struct rpcrdma_xprt *r_xprt)
 	/* Client offers RDMA Read but does not initiate */
 	ep->re_remote_cma.initiator_depth = 0;
 	ep->re_remote_cma.responder_resources =
-		min_t(int, U8_MAX, device->attrs.max_qp_rd_atom);
+		min_t(u32, U8_MAX, device->attrs.max_qp_rd_atom);
 
 	/* Limit transport retries so client can detect server
 	 * GID changes quickly. RPC layer handles re-establishing

Signature · 1 line

2.34.1

Bart Van Assche

maintainer

2026-06-01 15:52 UTC #1 lore raw

Quoted 36 lines · Erni Sri Satya Vennela

drivers/infiniband/ulp/srp/ib_srp.c +1 -1

index b58868e1cf11..dc30d069ab3d 100644
@@ -557,7 +557,7 @@ static int srp_create_ch_ib(struct srp_rdma_ch *ch)
  	init_attr->cap.max_send_wr     = m * target->queue_size;
  	init_attr->cap.max_recv_wr     = target->queue_size + 1;
  	init_attr->cap.max_recv_sge    = 1;
-	init_attr->cap.max_send_sge    = min(SRP_MAX_SGE, attr->max_send_sge);
+	init_attr->cap.max_send_sge    = min_t(u32, SRP_MAX_SGE, attr->max_send_sge);
  	init_attr->sq_sig_type         = IB_SIGNAL_REQ_WR;
  	init_attr->qp_type             = IB_QPT_RC;
  	init_attr->send_cq             = send_cq;

drivers/infiniband/ulp/srpt/ib_srpt.c +2 -2

index 9aec5d80117f..2ffa4f54cd4e 100644
@@ -1884,7 +1884,7 @@ static int srpt_create_ch_ib(struct srpt_rdma_ch *ch)
  	 * both both, as RDMA contexts will also post completions for the
  	 * RDMA READ case.
  	 */
-	qp_init->cap.max_send_wr = min(sq_size / 2, attrs->max_qp_wr);
+	qp_init->cap.max_send_wr = min_t(u32, sq_size / 2, attrs->max_qp_wr);
  	qp_init->cap.max_rdma_ctxs = sq_size / 2;
  	qp_init->cap.max_send_sge = attrs->max_send_sge;
  	qp_init->cap.max_recv_sge = 1;

@@ -2298,7 +2298,7 @@ static int srpt_cm_req_recv(struct srpt_device *const sdev,
  	 * depth to avoid that the initiator driver has to report QUEUE_FULL
  	 * to the SCSI mid-layer.
  	 */
-	ch->rq_size = min(MAX_SRPT_RQ_SIZE, sdev->device->attrs.max_qp_wr);
+	ch->rq_size = min_t(u32, MAX_SRPT_RQ_SIZE, sdev->device->attrs.max_qp_wr);
  	spin_lock_init(&ch->spinlock);
  	ch->state = CH_CONNECTING;
  	INIT_LIST_HEAD(&ch->cmd_wait_list);

drivers/infiniband/ulp/srpt/ib_srpt.c static int srpt_add_one(struct ib_device *device) · line 3230

Quoted 7 lines

drivers/infiniband/ulp/srpt/ib_srpt.c +1 -1

@@ -3225,7 +3225,7 @@ static int srpt_add_one(struct ib_device *device)
 
  	sdev->lkey = sdev->pd->local_dma_lkey;
 
-	sdev->srq_size = min(srpt_srq_size, sdev->device->attrs.max_srq_wr);
+	sdev->srq_size = min_t(u32, srpt_srq_size, sdev->device->attrs.max_srq_wr);
 
  	srpt_use_srq(sdev, sdev->port[0].port_attrib.use_srq);

min_t() shouldn't be used if there is an alternative available. For the SRP drivers, please make sure that both arguments of min() are unsigned instead of using min_t().

Thanks,

Bart.

Andy Shevchenko

2026-06-02 09:22 UTC #2 lore raw

Quoted 1 line · Bart Van Assche

On 6/1/26 2:25 AM, Erni Sri Satya Vennela wrote:

...

Quoted 6 lines

drivers/infiniband/ulp/srpt/ib_srpt.c static int srpt_add_one(struct ib_device *device) · line 3228
Quoted 2 lines
drivers/infiniband/ulp/srpt/ib_srpt.c +1 -1
-	sdev->srq_size = min(srpt_srq_size, sdev->device->attrs.max_srq_wr);
+	sdev->srq_size = min_t(u32, srpt_srq_size, sdev->device->attrs.max_srq_wr);
min_t() shouldn't be used if there is an alternative available. For the SRP drivers, please make sure that both arguments of min() are unsigned instead of using min_t().

Ah, I just answered in similar way against v5. I also mentioned clamp() there.

Signature · 2 lines

With Best Regards,
Andy Shevchenko

David Laight

2026-06-02 11:21 UTC #3 lore raw

Quoted 5 lines · On Tue, 2 Jun 2026 12:21:58 +0300 Andy Shevchenko…

Quoted 1 line · Bart Van Assche
On 6/1/26 2:25 AM, Erni Sri Satya Vennela wrote:
...

Quoted 9 lines

Quoted 6 lines
drivers/infiniband/ulp/srpt/ib_srpt.c static int srpt_add_one(struct ib_device *device) · line 3228
Quoted 2 lines
drivers/infiniband/ulp/srpt/ib_srpt.c +1 -1
-	sdev->srq_size = min(srpt_srq_size, sdev->device->attrs.max_srq_wr);
+	sdev->srq_size = min_t(u32, srpt_srq_size, sdev->device->attrs.max_srq_wr);  
min_t() shouldn't be used if there is an alternative available. For the SRP drivers, please make sure that both arguments of min() are unsigned instead of using min_t().
Ah, I just answered in similar way against v5. I also mentioned clamp() there.

IMHO it is also best to do min(value, 255) not min(255, value). Like an 'if' put the value you are comparing against second.

The min_t(u8, x, y) you've removed are usually broken.

Maybe I should change clamp() to allow clamp(int_var, 0, unsigned_var). That will need the order of the compares swapping (to do the low bound first).
I think they used to be that way around, got changed by a commit that said it didn't change it!
Correct code shouldn't care.

-- David

Erni Sri Satya Vennela

author

2026-06-06 06:59 UTC #4 lore raw

Quoted 21 lines · David Laight

Quoted 5 lines · On Tue, 2 Jun 2026 12:21:58 +0300 Andy Shevchenko…
Quoted 1 line · Bart Van Assche
On 6/1/26 2:25 AM, Erni Sri Satya Vennela wrote:
...
Quoted 9 lines
Quoted 6 lines
drivers/infiniband/ulp/srpt/ib_srpt.c static int srpt_add_one(struct ib_device *device) · line 3228
Quoted 2 lines
drivers/infiniband/ulp/srpt/ib_srpt.c +1 -1
-	sdev->srq_size = min(srpt_srq_size, sdev->device->attrs.max_srq_wr);
+	sdev->srq_size = min_t(u32, srpt_srq_size, sdev->device->attrs.max_srq_wr);  
min_t() shouldn't be used if there is an alternative available. For the SRP drivers, please make sure that both arguments of min() are unsigned instead of using min_t().
Ah, I just answered in similar way against v5. I also mentioned clamp() there.
IMHO it is also best to do min(value, 255) not min(255, value). Like an 'if' put the value you are comparing against second.

Quoted 9 lines

The min_t(u8, x, y) you've removed are usually broken.
Maybe I should change clamp() to allow clamp(int_var, 0, unsigned_var). That will need the order of the compares swapping (to do the low bound first).
I think they used to be that way around, got changed by a commit that said it didn't change it!
Correct code shouldn't care.

Thankyou for your suggestions, David.
I'll use min() in the way you suggested in the next version.

- Vennela

Erni Sri Satya Vennela

author

2026-06-06 06:50 UTC #5 lore raw

In reply to Andy Shevchenko

Quoted 5 lines · Andy Shevchenko

Quoted 1 line · Bart Van Assche
On 6/1/26 2:25 AM, Erni Sri Satya Vennela wrote:
...

Quoted 8 lines

Quoted 6 lines
drivers/infiniband/ulp/srpt/ib_srpt.c static int srpt_add_one(struct ib_device *device) · line 3228
Quoted 2 lines
drivers/infiniband/ulp/srpt/ib_srpt.c +1 -1
-	sdev->srq_size = min(srpt_srq_size, sdev->device->attrs.max_srq_wr);
+	sdev->srq_size = min_t(u32, srpt_srq_size, sdev->device->attrs.max_srq_wr);
min_t() shouldn't be used if there is an alternative available. For the SRP drivers, please make sure that both arguments of min() are unsigned instead of using min_t().
Ah, I just answered in similar way against v5. I also mentioned clamp() there.

Yes. I'll be incorporating those changes in the next version.

- Vennela

Quoted 5 lines

Signature · 3 lines
-- 
With Best Regards,
Andy Shevchenko

Erni Sri Satya Vennela

author

2026-06-06 06:48 UTC #6 lore raw

In reply to Bart Van Assche

Quoted 6 lines · Bart Van Assche

drivers/infiniband/ulp/srpt/ib_srpt.c +0 -1

-	ch->rq_size = min(MAX_SRPT_RQ_SIZE, sdev->device->attrs.max_qp_wr);

Quoted 5 lines

drivers/infiniband/ulp/srpt/ib_srpt.c +1 -0

+	ch->rq_size = min_t(u32, MAX_SRPT_RQ_SIZE, sdev->device->attrs.max_qp_wr);
  	spin_lock_init(&ch->spinlock);
  	ch->state = CH_CONNECTING;
  	INIT_LIST_HEAD(&ch->cmd_wait_list);

@@ -3225,7 +3225,7 @@ static int srpt_add_one(struct ib_device *device)

Quoted 8 lines

drivers/infiniband/ulp/srpt/ib_srpt.c static int srpt_add_one(struct ib_device *device) · line 3230
Quoted 4 lines
drivers/infiniband/ulp/srpt/ib_srpt.c +1 -1
  	sdev->lkey = sdev->pd->local_dma_lkey;
-	sdev->srq_size = min(srpt_srq_size, sdev->device->attrs.max_srq_wr);
+	sdev->srq_size = min_t(u32, srpt_srq_size, sdev->device->attrs.max_srq_wr);
  	srpt_use_srq(sdev, sdev->port[0].port_attrib.use_srq);
min_t() shouldn't be used if there is an alternative available. For the SRP drivers, please make sure that both arguments of min() are unsigned instead of using min_t().

Thankyou for your suggestion, Bart.
I'll update this in the next version.

- Vennela

Quoted 3 lines

Thanks,
Bart.

David Laight

2026-06-02 11:33 UTC #7 lore raw

In reply to Erni Sri Satya Vennela

Quoted 15 lines · On Mon, 1 Jun 2026 02:25:15 -0700 Erni Sri Satya Vennela…

The capability counter fields in struct ib_device_attr are declared as signed int, but these values are inherently non-negative. Drivers maintain their cached caps as u32 and assign them directly into these int fields; if a cap exceeds INT_MAX the implicit narrowing yields a negative value visible to the IB core.
Change the signed int capability fields to u32 to match the underlying nature of the data. Also update consumers across the IB core, ULPs, NVMe-oF target, RDS, and NFS/RDMA so the new u32 values are not forced back through signed int or u8 via min()/min_t() or narrowing local variables.
Suggested-by Jason Gunthorpe <[email protected]>
Signed-off-by Erni Sri Satya Vennela <[email protected]>
---

...

drivers/infiniband/ulp/rtrs/rtrs-srv.c static int create_con(struct rtrs_srv_path *srv_path, · line 1735

Quoted 11 lines

drivers/infiniband/ulp/rtrs/rtrs-srv.c +1 -1

index 6482ad859bd1..852213365ecd 100644
@@ -1731,7 +1731,7 @@ static int create_con(struct rtrs_srv_path *srv_path,
 		 * All receive and all send (each requiring invalidate)
 		 * + 2 for drain and heartbeat
 		 */
-		max_send_wr = min_t(int, wr_limit,
+		max_send_wr = min_t(u32, wr_limit,
 				    SERVICE_CON_QUEUE_DEPTH * 2 + 2);

That should compile as min().
(The constant is known to be non-negative.)

...

Quoted 4 lines

drivers/nvme/target/rdma.c +0 -0
index e6e2c3f9afdf..fd6923198ec1 100644

...

drivers/nvme/target/rdma.c static int nvmet_rdma_cm_accept(struct rdma_cm_id *cm_id, · line 1558

Quoted 8 lines

drivers/nvme/target/rdma.c +2 -2

@@ -1553,8 +1554,8 @@ static int nvmet_rdma_cm_accept(struct rdma_cm_id *cm_id,
 
 	param.rnr_retry_count = 7;
 	param.flow_control = 1;
-	param.initiator_depth = min_t(u8, p->initiator_depth,
-		queue->dev->device->attrs.max_qp_init_rd_atom);
+	param.initiator_depth = (u8)min_t(u32, p->initiator_depth,
+		min_t(u32, U8_MAX, queue->dev->device->attrs.max_qp_init_rd_atom));

I think you've change one of those to min_3(). Nesting min() is a good way to bloat the pre-processor output. You don't need any of the casts.

	param.initiator_depth = min_3(p->initiator_depth,
		queue->dev->device->attrs.max_qp_init_rd_atom, U8_MAX);

should be fine - if a bit long.

There are also (u32)U8_MAX casts lurking - pointless.

-- David

Erni Sri Satya Vennela

author

2026-06-06 07:01 UTC #8 lore raw

Quoted 6 lines · David Laight

drivers/infiniband/ulp/rtrs/rtrs-srv.c +0 -0
Quoted 5 lines
index 6482ad859bd1..852213365ecd 100644
drivers/infiniband/ulp/rtrs/rtrs-srv.c +0 -0
@@ -1731,7 +1731,7 @@ static int create_con(struct rtrs_srv_path *srv_path,
 		 * All receive and all send (each requiring invalidate)

Quoted 8 lines

drivers/infiniband/ulp/rtrs/rtrs-srv.c static int create_con(struct rtrs_srv_path *srv_path, · line 1735
Quoted 5 lines
drivers/infiniband/ulp/rtrs/rtrs-srv.c +1 -1
 		 * + 2 for drain and heartbeat
 		 */
-		max_send_wr = min_t(int, wr_limit,
+		max_send_wr = min_t(u32, wr_limit,
 				    SERVICE_CON_QUEUE_DEPTH * 2 + 2);
That should compile as min().
(The constant is known to be non-negative.)

Okay, I'll update this in the next version.

Quoted 20 lines

...
Quoted 4 lines
drivers/nvme/target/rdma.c +0 -0
index e6e2c3f9afdf..fd6923198ec1 100644
...
drivers/nvme/target/rdma.c static int nvmet_rdma_cm_accept(struct rdma_cm_id *cm_id, · line 1558
Quoted 8 lines
drivers/nvme/target/rdma.c +2 -2
@@ -1553,8 +1554,8 @@ static int nvmet_rdma_cm_accept(struct rdma_cm_id *cm_id,
 
 	param.rnr_retry_count = 7;
 	param.flow_control = 1;
-	param.initiator_depth = min_t(u8, p->initiator_depth,
-		queue->dev->device->attrs.max_qp_init_rd_atom);
+	param.initiator_depth = (u8)min_t(u32, p->initiator_depth,
+		min_t(u32, U8_MAX, queue->dev->device->attrs.max_qp_init_rd_atom));
I think you've change one of those to min_3(). Nesting min() is a good way to bloat the pre-processor output. You don't need any of the casts.

Quoted 6 lines

	param.initiator_depth = min_3(p->initiator_depth,
		queue->dev->device->attrs.max_qp_init_rd_atom, U8_MAX);
should be fine - if a bit long.
There are also (u32)U8_MAX casts lurking - pointless.

Okay. I'll use min3 as suggested in the next version and remove unneccesary casts.

Thanks,
Vennela

Quoted 1 line

-- David