RDMA/bnxt_re: Fix a bunch of off by one bugs in qplib_fp.c

BugLink: https://bugs.launchpad.net/bugs/1836287
[ Upstream commit c1dfc0114c901b4f46c85ceff0491debf2b2a2ec ]

The srq->swq[] is allocated in bnxt_qplib_create_srq().  It has
srq->hwq.max_elements elements so these tests should be > instead of >=
or we might go beyond the end of the array.

Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Selvin Xavier <selvin.xavier@broadcom.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Khalid Elmously <khalid.elmously@canonical.com>

diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
index 61764f7aa79b5eeb9515027dcf04e4d5cb09b76b..8ab3096e2998ec644b76a42b7f8a36d8b30766fd 100644 (file)
--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
@@ -2103,7 +2103,7 @@ static int bnxt_qplib_cq_process_res_rc(struct bnxt_qplib_cq *cq,
        wr_id_idx = le32_to_cpu(hwcqe->srq_or_rq_wr_id) &
                                CQ_RES_RC_SRQ_OR_RQ_WR_ID_MASK;
        rq = &qp->rq;
-       if (wr_id_idx > rq->hwq.max_elements) {
+       if (wr_id_idx >= rq->hwq.max_elements) {
                dev_err(&cq->hwq.pdev->dev, "QPLIB: FP: CQ Process RC ");
                dev_err(&cq->hwq.pdev->dev,
                        "QPLIB: wr_id idx 0x%x exceeded RQ max 0x%x",
@@ -2167,7 +2167,7 @@ static int bnxt_qplib_cq_process_res_ud(struct bnxt_qplib_cq *cq,
                                 CQ_RES_UD_SRC_QP_HIGH_MASK) >> 8);
 
        rq = &qp->rq;
-       if (wr_id_idx > rq->hwq.max_elements) {
+       if (wr_id_idx >= rq->hwq.max_elements) {
                dev_err(&cq->hwq.pdev->dev, "QPLIB: FP: CQ Process UD ");
                dev_err(&cq->hwq.pdev->dev,
                        "QPLIB: wr_id idx %#x exceeded RQ max %#x",
@@ -2257,7 +2257,7 @@ static int bnxt_qplib_cq_process_res_raweth_qp1(struct bnxt_qplib_cq *cq,
        cqe->raweth_qp1_metadata = le32_to_cpu(hwcqe->raweth_qp1_metadata);
 
        rq = &qp->rq;
-       if (wr_id_idx > rq->hwq.max_elements) {
+       if (wr_id_idx >= rq->hwq.max_elements) {
                dev_err(&cq->hwq.pdev->dev, "QPLIB: FP: CQ Process Raw/QP1 RQ wr_id ");
                dev_err(&cq->hwq.pdev->dev, "QPLIB: ix 0x%x exceeded RQ max 0x%x",
                        wr_id_idx, rq->hwq.max_elements);