[lvc-project] [PATCH v2] RDMA/hns: Fix arithmetic overflow in hns_roce_v2_set_hem()

[Alexander.Chesnokov at kaspersky.com]

From: Alexander Chesnokov <Alexander.Chesnokov at kaspersky.com>

If hop_num is 2 or 1, then the expressions like
i * chunk_ba_num + j are computed in 32-bit
arithmetic before being assigned to a u64 index field,
which can lead to overflow.

Declare i, j and k as u64 so that the address index
arithmetic is performed in 64-bit.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: a81fba28136d ("RDMA/hns: Configure BT BA and BT attribute for the contexts in hip08")
Cc: stable at vger.kernel.org
Suggested-by: David Laight <david.laight.linux at gmail.com>
Signed-off-by: Alexander Chesnokov <Alexander.Chesnokov at kaspersky.com>

---
Changes in v2:
- Instead of casting the operands to u64, declare i, j and k as u64
  so the index arithmetic is performed in 64-bit (David Laight).

v1: https://lore.kernel.org/linux-rdma/20260707140938.3106919-1-Alexander.Chesnokov@kaspersky.com/
---
 drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
index 1c180a6b1c07..3469a9a68d3b 100644
--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
@@ -4238,7 +4238,7 @@ static int hns_roce_v2_set_hem(struct hns_roce_dev *hr_dev,
 	struct hns_roce_hem_mhop mhop;
 	struct hns_roce_hem *hem;
 	unsigned long mhop_obj = obj;
-	int i, j, k;
+	u64 i, j, k;
 	int ret = 0;
 	u64 hem_idx = 0;
 	u64 l1_idx = 0;
-- 
2.43.0