From: Dennis Dalessandro <dennis.dalessandro@intel.com>
Date: Tue, 30 May 2017 00:19:21 +0000 (-0700)
Subject: IB/hfi1: Use QPN mask to avoid overflow
X-Git-Url: http://git.maquefel.me/?a=commitdiff_plain;h=6c31e5283cb06b81a13cc88da2f2ad3db594a935;p=linux.git

IB/hfi1: Use QPN mask to avoid overflow

Ensure we can't come up with an array size that is bigger than the array
by applying the QPN mask before the divide in the free_qpn function.

Reviewed-by: Michael J. Ruhl <michael.j.ruhl@intel.com>
Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
---

diff --git a/drivers/infiniband/sw/rdmavt/qp.c b/drivers/infiniband/sw/rdmavt/qp.c
index a372afbbfbef2..2ce0928dddd64 100644
--- a/drivers/infiniband/sw/rdmavt/qp.c
+++ b/drivers/infiniband/sw/rdmavt/qp.c
@@ -645,7 +645,7 @@ static void rvt_free_qpn(struct rvt_qpn_table *qpt, u32 qpn)
 {
 	struct rvt_qpn_map *map;
 
-	map = qpt->map + qpn / RVT_BITS_PER_PAGE;
+	map = qpt->map + (qpn & RVT_QPN_MASK) / RVT_BITS_PER_PAGE;
 	if (map->page)
 		clear_bit(qpn & RVT_BITS_PER_PAGE_MASK, map->page);
 }