[lvc-project] [PATCH] RDMA/hns: Fix arithmetic overflow in hns_roce_v2_set_hem()

[Alexander.Chesnokov at kaspersky.com]

From: Alexander Chesnokov <Alexander.Chesnokov at kaspersky.com>

If hop_num is 2 or 1, then the expressions like
i * chunk_ba_num + j are computed in 32-bit
arithmetic before being assigned to a u64 index field,
which can lead to overflow.

Cast the first operand to u64 to ensure the arithmetic
is performed in 64-bit.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: a81fba28136d ("RDMA/hns: Configure BT BA and BT attribute for the contexts in hip08")
Cc: stable at vger.kernel.org
Signed-off-by: Alexander Chesnokov <Alexander.Chesnokov at kaspersky.com>
---
 drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
index 1c180a6b1c07..b62513b4db09 100644
--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
@@ -4257,11 +4257,11 @@ static int hns_roce_v2_set_hem(struct hns_roce_dev *hr_dev,
 	chunk_ba_num = mhop.bt_chunk_size / 8;
 
 	if (hop_num == 2) {
-		hem_idx = i * chunk_ba_num * chunk_ba_num + j * chunk_ba_num +
+		hem_idx = (u64)i * chunk_ba_num * chunk_ba_num + (u64)j * chunk_ba_num +
 			  k;
-		l1_idx = i * chunk_ba_num + j;
+		l1_idx = (u64)i * chunk_ba_num + j;
 	} else if (hop_num == 1) {
-		hem_idx = i * chunk_ba_num + j;
+		hem_idx = (u64)i * chunk_ba_num + j;
 	} else if (hop_num == HNS_ROCE_HOP_NUM_0) {
 		hem_idx = i;
 	}
-- 
2.43.0