Hello Maor Gottlieb,
The patch cea85fa5dbc2: "RDMA/mlx5: Add support in MEMIC operations"
from Apr 11, 2021, leads to the following static checker warning:
drivers/infiniband/hw/mlx5/dm.c:220 mlx5_ib_handler_MLX5_IB_METHOD_DM_MAP_OP_ADDR()
error: undefined (user controlled) shift '(((1))) << op'
drivers/infiniband/hw/mlx5/dm.c
204 static int UVERBS_HANDLER(MLX5_IB_METHOD_DM_MAP_OP_ADDR)(
205 struct uverbs_attr_bundle *attrs)
206 {
207 struct ib_uobject *uobj = uverbs_attr_get_uobject(
208 attrs, MLX5_IB_ATTR_DM_MAP_OP_ADDR_REQ_HANDLE);
209 struct mlx5_ib_dev *dev = to_mdev(uobj->context->device);
210 struct ib_dm *ibdm = uobj->object;
211 struct mlx5_ib_dm_memic *dm = to_memic(ibdm);
212 struct mlx5_ib_dm_op_entry *op_entry;
213 int err;
214 u8 op;
215
216 err = uverbs_copy_from(&op, attrs, MLX5_IB_ATTR_DM_MAP_OP_ADDR_REQ_OP);
^^
op is user controlled and in the 0-255 range.
217 if (err)
218 return err;
219
220 if (!(MLX5_CAP_DEV_MEM(dev->mdev, memic_operations) & BIT(op)))
^^^^^^^
If it's more than 31 then this is undefined (shift wrapping generally).
Plus it might trigger a UBSan warning at run time.
221 return -EOPNOTSUPP;
222
223 mutex_lock(&dm->ops_xa_lock);
regards,
dan carpenter
