[PATCH rdma-next 15/15] RDMA/mlx5: Fix signed integer overflow in EQE qp_srq type shift

eqe->data.qp_srq.type is a u8 field (values 0-255). Shifting it left by
MLX5_USER_INDEX_LEN (24) promotes it to signed int before the shift,
causing undefined behavior when type >= 128: the result overflows into
the sign bit of int, which a signed-overflow sanitizer would flag.

Cast to u32 before the shift so the operation is well-defined across the
full 0-255 range of the EQE-supplied type field.

All currently defined and used type values (QP=0, RQ=1, SQ=2, SRQ=3,
XSRQ=4, XRQ=5, DCT=6) are well below 128, so this is not a bug that
manifests with current hardware. The cast is a preventive fix to make
the code well-defined against any future or firmware-forged type value.

Signed-off-by: Yishai Hadas <yishaih@nvidia.com>
---
 drivers/infiniband/hw/mlx5/qpc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/infiniband/hw/mlx5/qpc.c b/drivers/infiniband/hw/mlx5/qpc.c
index 8b5bd33a7f0f..ce2ef8828c09 100644
--- a/drivers/infiniband/hw/mlx5/qpc.c
+++ b/drivers/infiniband/hw/mlx5/qpc.c

@@ -128,7 +128,7 @@ static int rsc_event_notifier(struct notifier_block *nb,
 	case MLX5_EVENT_TYPE_WQ_INVAL_REQ_ERROR:
 	case MLX5_EVENT_TYPE_WQ_ACCESS_ERROR:
 		rsn = be32_to_cpu(eqe->data.qp_srq.qp_srq_n) & 0xffffff;
-		rsn |= (eqe->data.qp_srq.type << MLX5_USER_INDEX_LEN);
+		rsn |= ((u32)eqe->data.qp_srq.type << MLX5_USER_INDEX_LEN);
 		break;
 	default:
 		return NOTIFY_DONE;

-- 
2.18.1