mlx4: Fix signed-overflow UB in mlx4_cq_clean() sweep condition

[ Upstream commit 9d43cfc0896433e28a3a3ac713aa7c465c8df93c ]

The backward sweep in mlx4_cq_clean() used:

  while ((int) --prod_index - (int) cq->cons_index >= 0)

Both operands are uint32_t.  Promoting them to int and then subtracting
is undefined behaviour when the result overflows (C11 §6.5p5).  GCC and
Clang exploit that UB: they fold "(int)a - (int)b >= 0" into the plain
signed compare "(int)a >= (int)b", which has no exit when cons_index is
0x80000000 (INT_MIN), causing an infinite loop with the CQ spinlock held.

Replace with a plain unsigned equality check — identical fix to the one
applied to providers/mlx5/cq.c:

  while (prod_index != cq->cons_index) { --prod_index; ... }

prod_index starts at the value found by the forward scan, which begins
at cons_index and only increments, so prod_index >= cons_index always
holds.  Decrementing prod_index each iteration reaches cons_index in
exactly (prod_index - cons_index) steps.  No arithmetic on the loop
condition, no signed casts, no compiler-visible UB.

Fixes: 3e44e8d14a32 ("Implement mlx4_cq_clean()")
Signed-off-by: Yishai Hadas <yishaih@nvidia.com>
Signed-off-by: Nicolas Morey <nmorey@suse.com>

providers/mlx4/cq.c

diff --git a/providers/mlx4/cq.c b/providers/mlx4/cq.c
index 61313b8..e17ae22 100644
--- a/providers/mlx4/cq.c
+++ b/providers/mlx4/cq.c
@@ -700,7 +700,8 @@
 	 * Now sweep backwards through the CQ, removing CQ entries
 	 * that match our QP by copying older entries on top of them.
 	 */
-	while ((int) --prod_index - (int) cq->cons_index >= 0) {
+	while (prod_index != cq->cons_index) {
+		--prod_index;
 		cqe = get_cqe(cq, prod_index & cq->verbs_cq.cq.cqe);
 		cqe += cqe_inc;
 		if (srq && srq->ext_srq &&