[PATCH] RDMA/hns: Fix arithmetic overflow in hns_roce_v2_set_hem()

[PATCH] RDMA/hns: Fix arithmetic overflow in hns_roce_v2_set_hem()

[Alexander.Chesnokov]

From: Alexander Chesnokov <Alexander.Chesnokov@kaspersky.com>

If hop_num is 2 or 1, then the expressions like
i * chunk_ba_num + j are computed in 32-bit
arithmetic before being assigned to a u64 index field,
which can lead to overflow.

Cast the first operand to u64 to ensure the arithmetic
is performed in 64-bit.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: a81fba28136d ("RDMA/hns: Configure BT BA and BT attribute for the contexts in hip08")
Cc: stable@vger.kernel.org
Signed-off-by: Alexander Chesnokov <Alexander.Chesnokov@kaspersky.com>
---
 drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
index 1c180a6b1c07..b62513b4db09 100644
--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
@@ -4257,11 +4257,11 @@ static int hns_roce_v2_set_hem(struct hns_roce_dev *hr_dev,
 	chunk_ba_num = mhop.bt_chunk_size / 8;
 
 	if (hop_num == 2) {
-		hem_idx = i * chunk_ba_num * chunk_ba_num + j * chunk_ba_num +
+		hem_idx = (u64)i * chunk_ba_num * chunk_ba_num + (u64)j * chunk_ba_num +
 			  k;
-		l1_idx = i * chunk_ba_num + j;
+		l1_idx = (u64)i * chunk_ba_num + j;
 	} else if (hop_num == 1) {
-		hem_idx = i * chunk_ba_num + j;
+		hem_idx = (u64)i * chunk_ba_num + j;
 	} else if (hop_num == HNS_ROCE_HOP_NUM_0) {
 		hem_idx = i;
 	}
-- 
2.43.0

Re: [PATCH] RDMA/hns: Fix arithmetic overflow in hns_roce_v2_set_hem()

[David Laight]

On Tue, 7 Jul 2026 17:09:38 +0300
<Alexander.Chesnokov@kaspersky.com> wrote:

> From: Alexander Chesnokov <Alexander.Chesnokov@kaspersky.com>
> 
> If hop_num is 2 or 1, then the expressions like
> i * chunk_ba_num + j are computed in 32-bit
> arithmetic before being assigned to a u64 index field,
> which can lead to overflow.
> 
> Cast the first operand to u64 to ensure the arithmetic
> is performed in 64-bit.

If the values can be 64bit it would be better to just make i/j/k u64.

	David

> 
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
> 
> Fixes: a81fba28136d ("RDMA/hns: Configure BT BA and BT attribute for the contexts in hip08")
> Cc: stable@vger.kernel.org
> Signed-off-by: Alexander Chesnokov <Alexander.Chesnokov@kaspersky.com>
> ---
>  drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
> index 1c180a6b1c07..b62513b4db09 100644
> --- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
> +++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
> @@ -4257,11 +4257,11 @@ static int hns_roce_v2_set_hem(struct hns_roce_dev *hr_dev,
>  	chunk_ba_num = mhop.bt_chunk_size / 8;
>  
>  	if (hop_num == 2) {
> -		hem_idx = i * chunk_ba_num * chunk_ba_num + j * chunk_ba_num +
> +		hem_idx = (u64)i * chunk_ba_num * chunk_ba_num + (u64)j * chunk_ba_num +
>  			  k;
> -		l1_idx = i * chunk_ba_num + j;
> +		l1_idx = (u64)i * chunk_ba_num + j;
>  	} else if (hop_num == 1) {
> -		hem_idx = i * chunk_ba_num + j;
> +		hem_idx = (u64)i * chunk_ba_num + j;
>  	} else if (hop_num == HNS_ROCE_HOP_NUM_0) {
>  		hem_idx = i;
>  	}

[PATCH v2] RDMA/hns: Fix arithmetic overflow in hns_roce_v2_set_hem()

[Alexander.Chesnokov]

From: Alexander Chesnokov <Alexander.Chesnokov@kaspersky.com>

If hop_num is 2 or 1, then the expressions like
i * chunk_ba_num + j are computed in 32-bit
arithmetic before being assigned to a u64 index field,
which can lead to overflow.

Declare i, j and k as u64 so that the address index
arithmetic is performed in 64-bit.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: a81fba28136d ("RDMA/hns: Configure BT BA and BT attribute for the contexts in hip08")
Cc: stable@vger.kernel.org
Suggested-by: David Laight <david.laight.linux@gmail.com>
Signed-off-by: Alexander Chesnokov <Alexander.Chesnokov@kaspersky.com>

---
Changes in v2:
- Instead of casting the operands to u64, declare i, j and k as u64
  so the index arithmetic is performed in 64-bit (David Laight).

v1: https://lore.kernel.org/linux-rdma/20260707140938.3106919-1-Alexander.Chesnokov@kaspersky.com/
---
 drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
index 1c180a6b1c07..3469a9a68d3b 100644
--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
@@ -4238,7 +4238,7 @@ static int hns_roce_v2_set_hem(struct hns_roce_dev *hr_dev,
 	struct hns_roce_hem_mhop mhop;
 	struct hns_roce_hem *hem;
 	unsigned long mhop_obj = obj;
-	int i, j, k;
+	u64 i, j, k;
 	int ret = 0;
 	u64 hem_idx = 0;
 	u64 l1_idx = 0;
-- 
2.43.0

Re: [PATCH v2] RDMA/hns: Fix arithmetic overflow in hns_roce_v2_set_hem()

[Leon Romanovsky]

On Wed, Jul 08, 2026 at 12:21:46PM +0300, Alexander.Chesnokov@kaspersky.com wrote:
> From: Alexander Chesnokov <Alexander.Chesnokov@kaspersky.com>
> 
> If hop_num is 2 or 1, then the expressions like
> i * chunk_ba_num + j are computed in 32-bit
> arithmetic before being assigned to a u64 index field,
> which can lead to overflow.
> 
> Declare i, j and k as u64 so that the address index
> arithmetic is performed in 64-bit.
> 
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
> 
> Fixes: a81fba28136d ("RDMA/hns: Configure BT BA and BT attribute for the contexts in hip08")
> Cc: stable@vger.kernel.org
> Suggested-by: David Laight <david.laight.linux@gmail.com>
> Signed-off-by: Alexander Chesnokov <Alexander.Chesnokov@kaspersky.com>

Please resend this patch as standalone message without "Reply-to".

Thanks

> 
> ---
> Changes in v2:
> - Instead of casting the operands to u64, declare i, j and k as u64
>   so the index arithmetic is performed in 64-bit (David Laight).
> 
> v1: https://lore.kernel.org/linux-rdma/20260707140938.3106919-1-Alexander.Chesnokov@kaspersky.com/
> ---
>  drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
> index 1c180a6b1c07..3469a9a68d3b 100644
> --- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
> +++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
> @@ -4238,7 +4238,7 @@ static int hns_roce_v2_set_hem(struct hns_roce_dev *hr_dev,
>  	struct hns_roce_hem_mhop mhop;
>  	struct hns_roce_hem *hem;
>  	unsigned long mhop_obj = obj;
> -	int i, j, k;
> +	u64 i, j, k;
>  	int ret = 0;
>  	u64 hem_idx = 0;
>  	u64 l1_idx = 0;
> -- 
> 2.43.0
> 

Re: [PATCH v2] RDMA/hns: Fix arithmetic overflow in hns_roce_v2_set_hem()

[David Laight]

On Wed, 8 Jul 2026 12:21:46 +0300
<Alexander.Chesnokov@kaspersky.com> wrote:

> From: Alexander Chesnokov <Alexander.Chesnokov@kaspersky.com>
> 
> If hop_num is 2 or 1, then the expressions like
> i * chunk_ba_num + j are computed in 32-bit
> arithmetic before being assigned to a u64 index field,
> which can lead to overflow.

When does the value overflow.
Yes, the expression can overflow and the result is assigned to a 64bit
variable, but I'd have testing this code would have showed the problem.

So what is the customer visible impact?

	David

> 
> Declare i, j and k as u64 so that the address index
> arithmetic is performed in 64-bit.
> 
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
> 
> Fixes: a81fba28136d ("RDMA/hns: Configure BT BA and BT attribute for the contexts in hip08")
> Cc: stable@vger.kernel.org
> Suggested-by: David Laight <david.laight.linux@gmail.com>
> Signed-off-by: Alexander Chesnokov <Alexander.Chesnokov@kaspersky.com>
> 
> ---
> Changes in v2:
> - Instead of casting the operands to u64, declare i, j and k as u64
>   so the index arithmetic is performed in 64-bit (David Laight).
> 
> v1: https://lore.kernel.org/linux-rdma/20260707140938.3106919-1-Alexander.Chesnokov@kaspersky.com/
> ---
>  drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
> index 1c180a6b1c07..3469a9a68d3b 100644
> --- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
> +++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
> @@ -4238,7 +4238,7 @@ static int hns_roce_v2_set_hem(struct hns_roce_dev *hr_dev,
>  	struct hns_roce_hem_mhop mhop;
>  	struct hns_roce_hem *hem;
>  	unsigned long mhop_obj = obj;
> -	int i, j, k;
> +	u64 i, j, k;
>  	int ret = 0;
>  	u64 hem_idx = 0;
>  	u64 l1_idx = 0;

RE: [PATCH v2] RDMA/hns: Fix arithmetic overflow in hns_roce_v2_set_hem()

[Alexander Chesnokov]

> When does the value overflow.
> Yes, the expression can overflow and the result is assigned to a
> 64bit variable, but I'd have testing this code would have showed
> the problem. So what is the customer visible impact?

You're right, there is no reachable overflow. In hns_roce_calc_hem_mhop()
the 32-bit table_idx is split into base-chunk_ba_num digits i, j, k, and
here they are recombined: i * chunk_ba_num + j equals table_idx /
chunk_ba_num, and the full expression equals table_idx, which is u32.
i is additionally bounded by ba_l0_num. So the arithmetic cannot exceed
U32_MAX on any real input - there is no customer-visible impact, and the
SVACE report is a false positive.

I'll drop the Fixes: and Cc: stable tags and resend as a standalone
hardening/readability change. If you'd prefer to just drop it, that's
fine too.

-----Original Message-----
From: David Laight <david.laight.linux@gmail.com> 
Sent: Wednesday, July 8, 2026 8:20 PM
To: Alexander Chesnokov <Alexander.Chesnokov@kaspersky.com>
Cc: xuhaoyue1@hisilicon.com; lvc-project@linuxtesting.org; Oleg Kazakov <Oleg.Kazakov@kaspersky.com>; Pavel Zhigulin <Pavel.Zhigulin@kaspersky.com>; stable@vger.kernel.org; Wenpeng Liang <liangwenpeng@huawei.com>; Jason Gunthorpe <jgg@ziepe.ca>; Leon Romanovsky <leon@kernel.org>; Xi Wang <wangxi11@huawei.com>; Weihang Li <liweihang@huawei.com>; linux-rdma@vger.kernel.org; linux-kernel@vger.kernel.org
Subject: Re: [PATCH v2] RDMA/hns: Fix arithmetic overflow in hns_roce_v2_set_hem()

Caution: This is an external email.



On Wed, 8 Jul 2026 12:21:46 +0300
<Alexander.Chesnokov@kaspersky.com> wrote:

> From: Alexander Chesnokov <Alexander.Chesnokov@kaspersky.com>
>
> If hop_num is 2 or 1, then the expressions like i * chunk_ba_num + j 
> are computed in 32-bit arithmetic before being assigned to a u64 index 
> field, which can lead to overflow.

When does the value overflow.
Yes, the expression can overflow and the result is assigned to a 64bit variable, but I'd have testing this code would have showed the problem.

So what is the customer visible impact?

        David

>
> Declare i, j and k as u64 so that the address index arithmetic is 
> performed in 64-bit.
>
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
>
> Fixes: a81fba28136d ("RDMA/hns: Configure BT BA and BT attribute for 
> the contexts in hip08")
> Cc: stable@vger.kernel.org
> Suggested-by: David Laight <david.laight.linux@gmail.com>
> Signed-off-by: Alexander Chesnokov <Alexander.Chesnokov@kaspersky.com>
>
> ---
> Changes in v2:
> - Instead of casting the operands to u64, declare i, j and k as u64
>   so the index arithmetic is performed in 64-bit (David Laight).
>
> v1: 
> https://lore.kernel.org/linux-rdma/20260707140938.3106919-1-Alexander.
> Chesnokov@kaspersky.com/
> ---
>  drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c 
> b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
> index 1c180a6b1c07..3469a9a68d3b 100644
> --- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
> +++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
> @@ -4238,7 +4238,7 @@ static int hns_roce_v2_set_hem(struct hns_roce_dev *hr_dev,
>       struct hns_roce_hem_mhop mhop;
>       struct hns_roce_hem *hem;
>       unsigned long mhop_obj = obj;
> -     int i, j, k;
> +     u64 i, j, k;
>       int ret = 0;
>       u64 hem_idx = 0;
>       u64 l1_idx = 0;

Re: [PATCH v2] RDMA/hns: Fix arithmetic overflow in hns_roce_v2_set_hem()

[David Laight]

On Thu, 9 Jul 2026 04:56:56 +0000
Alexander Chesnokov <Alexander.Chesnokov@kaspersky.com> wrote:

> > When does the value overflow.
> > Yes, the expression can overflow and the result is assigned to a
> > 64bit variable, but I'd have testing this code would have showed
> > the problem. So what is the customer visible impact?  
> 
> You're right, there is no reachable overflow. In hns_roce_calc_hem_mhop()
> the 32-bit table_idx is split into base-chunk_ba_num digits i, j, k, and
> here they are recombined: i * chunk_ba_num + j equals table_idx /
> chunk_ba_num, and the full expression equals table_idx, which is u32.
> i is additionally bounded by ba_l0_num. So the arithmetic cannot exceed
> U32_MAX on any real input - there is no customer-visible impact, and the
> SVACE report is a false positive.
> 
> I'll drop the Fixes: and Cc: stable tags and resend as a standalone
> hardening/readability change. If you'd prefer to just drop it, that's
> fine too.

Best just dropped.

	David

> 
> -----Original Message-----
> From: David Laight <david.laight.linux@gmail.com> 
> Sent: Wednesday, July 8, 2026 8:20 PM
> To: Alexander Chesnokov <Alexander.Chesnokov@kaspersky.com>
> Cc: xuhaoyue1@hisilicon.com; lvc-project@linuxtesting.org; Oleg Kazakov <Oleg.Kazakov@kaspersky.com>; Pavel Zhigulin <Pavel.Zhigulin@kaspersky.com>; stable@vger.kernel.org; Wenpeng Liang <liangwenpeng@huawei.com>; Jason Gunthorpe <jgg@ziepe.ca>; Leon Romanovsky <leon@kernel.org>; Xi Wang <wangxi11@huawei.com>; Weihang Li <liweihang@huawei.com>; linux-rdma@vger.kernel.org; linux-kernel@vger.kernel.org
> Subject: Re: [PATCH v2] RDMA/hns: Fix arithmetic overflow in hns_roce_v2_set_hem()
> 
> Caution: This is an external email.
> 
> 
> 
> On Wed, 8 Jul 2026 12:21:46 +0300
> <Alexander.Chesnokov@kaspersky.com> wrote:
> 
> > From: Alexander Chesnokov <Alexander.Chesnokov@kaspersky.com>
> >
> > If hop_num is 2 or 1, then the expressions like i * chunk_ba_num + j 
> > are computed in 32-bit arithmetic before being assigned to a u64 index 
> > field, which can lead to overflow.  
> 
> When does the value overflow.
> Yes, the expression can overflow and the result is assigned to a 64bit variable, but I'd have testing this code would have showed the problem.
> 
> So what is the customer visible impact?
> 
>         David
> 
> >
> > Declare i, j and k as u64 so that the address index arithmetic is 
> > performed in 64-bit.
> >
> > Found by Linux Verification Center (linuxtesting.org) with SVACE.
> >
> > Fixes: a81fba28136d ("RDMA/hns: Configure BT BA and BT attribute for 
> > the contexts in hip08")
> > Cc: stable@vger.kernel.org
> > Suggested-by: David Laight <david.laight.linux@gmail.com>
> > Signed-off-by: Alexander Chesnokov <Alexander.Chesnokov@kaspersky.com>
> >
> > ---
> > Changes in v2:
> > - Instead of casting the operands to u64, declare i, j and k as u64
> >   so the index arithmetic is performed in 64-bit (David Laight).
> >
> > v1: 
> > https://lore.kernel.org/linux-rdma/20260707140938.3106919-1-Alexander.
> > Chesnokov@kaspersky.com/
> > ---
> >  drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c 
> > b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
> > index 1c180a6b1c07..3469a9a68d3b 100644
> > --- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
> > +++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
> > @@ -4238,7 +4238,7 @@ static int hns_roce_v2_set_hem(struct hns_roce_dev *hr_dev,
> >       struct hns_roce_hem_mhop mhop;
> >       struct hns_roce_hem *hem;
> >       unsigned long mhop_obj = obj;
> > -     int i, j, k;
> > +     u64 i, j, k;
> >       int ret = 0;
> >       u64 hem_idx = 0;
> >       u64 l1_idx = 0;  
>