[PATCH for-rc 7/7] RDMA/bnxt_re: Bound FRMR page list by max_num_sg

[Selvin Xavier <selvin.xavier@broadcom.com>]

bnxt_re_set_page() checks against frpl->max_pg_ptrs, which is rounded up
to a power of two, while mr->pages[] is allocated with max_num_sg
entries. For a non-power-of-two max_num_sg, ib_sg_to_pages() can write
past the end of mr->pages[].

Track the allocated size in mr->max_pages and bound against it. Also
reject max_num_sg of 0.

Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver")
Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
---
 drivers/infiniband/hw/bnxt_re/ib_verbs.c | 5 +++--
 drivers/infiniband/hw/bnxt_re/ib_verbs.h | 1 +
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
index 1ca481806578..811f59f02f75 100644
--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
@@ -4555,7 +4555,7 @@ static int bnxt_re_set_page(struct ib_mr *ib_mr, u64 addr)
 {
 	struct bnxt_re_mr *mr = container_of(ib_mr, struct bnxt_re_mr, ib_mr);
 
-	if (unlikely(mr->npages == mr->qplib_frpl.max_pg_ptrs))
+	if (unlikely(mr->npages == mr->max_pages))
 		return -ENOMEM;
 
 	mr->pages[mr->npages++] = addr;
@@ -4584,7 +4584,7 @@ struct ib_mr *bnxt_re_alloc_mr(struct ib_pd *ib_pd, enum ib_mr_type type,
 		ibdev_dbg(&rdev->ibdev, "MR type 0x%x not supported", type);
 		return ERR_PTR(-EINVAL);
 	}
-	if (max_num_sg > MAX_PBL_LVL_1_PGS)
+	if (!max_num_sg || max_num_sg > MAX_PBL_LVL_1_PGS)
 		return ERR_PTR(-EINVAL);
 
 	mr = kzalloc_obj(*mr);
@@ -4603,6 +4603,7 @@ struct ib_mr *bnxt_re_alloc_mr(struct ib_pd *ib_pd, enum ib_mr_type type,
 	mr->ib_mr.lkey = mr->qplib_mr.lkey;
 	mr->ib_mr.rkey = mr->ib_mr.lkey;
 
+	mr->max_pages = max_num_sg;
 	mr->pages = kzalloc_objs(u64, max_num_sg);
 	if (!mr->pages) {
 		rc = -ENOMEM;
diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.h b/drivers/infiniband/hw/bnxt_re/ib_verbs.h
index b7b33f6acf91..d12cadaef10c 100644
--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.h
+++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.h
@@ -124,6 +124,7 @@ struct bnxt_re_mr {
 	struct ib_umem		*ib_umem;
 	struct bnxt_qplib_mrw	qplib_mr;
 	u32			npages;
+	u32			max_pages;
 	u64			*pages;
 	struct bnxt_qplib_frpl	qplib_frpl;
 };
-- 
2.39.3