Patch "net: ethernet: mlx4: Fix memory allocation in mlx4_buddy_init()" has been added to the 5.4-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    net: ethernet: mlx4: Fix memory allocation in mlx4_buddy_init()

to the 5.4-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     net-ethernet-mlx4-fix-memory-allocation-in-mlx4_budd.patch
and it can be found in the queue-5.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit e93d143f4f8ebe760b5fa97f41f02a6d0e5e6def
Author: Shung-Hsi Yu <shung-hsi.yu@xxxxxxxx>
Date:   Mon Aug 31 22:37:09 2020 +0800

    net: ethernet: mlx4: Fix memory allocation in mlx4_buddy_init()
    
    [ Upstream commit cbedcb044e9cc4e14bbe6658111224bb923094f4 ]
    
    On machines with much memory (> 2 TByte) and log_mtts_per_seg == 0, a
    max_order of 31 will be passed to mlx_buddy_init(), which results in
    s = BITS_TO_LONGS(1 << 31) becoming a negative value, leading to
    kvmalloc_array() failure when it is converted to size_t.
    
      mlx4_core 0000:b1:00.0: Failed to initialize memory region table, aborting
      mlx4_core: probe of 0000:b1:00.0 failed with error -12
    
    Fix this issue by changing the left shifting operand from a signed literal to
    an unsigned one.
    
    Fixes: 225c7b1feef1 ("IB/mlx4: Add a driver Mellanox ConnectX InfiniBand adapters")
    Signed-off-by: Shung-Hsi Yu <shung-hsi.yu@xxxxxxxx>
    Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/net/ethernet/mellanox/mlx4/mr.c b/drivers/net/ethernet/mellanox/mlx4/mr.c
index 1a11bc0e16123..cfa0bba3940fb 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mr.c
+++ b/drivers/net/ethernet/mellanox/mlx4/mr.c
@@ -114,7 +114,7 @@ static int mlx4_buddy_init(struct mlx4_buddy *buddy, int max_order)
 		goto err_out;
 
 	for (i = 0; i <= buddy->max_order; ++i) {
-		s = BITS_TO_LONGS(1 << (buddy->max_order - i));
+		s = BITS_TO_LONGS(1UL << (buddy->max_order - i));
 		buddy->bits[i] = kvmalloc_array(s, sizeof(long), GFP_KERNEL | __GFP_ZERO);
 		if (!buddy->bits[i])
 			goto err_out_free;