mlx4: Fix signed-overflow UB in mlx4_cq_clean() sweep condition

[ Upstream commit 9d43cfc0896433e28a3a3ac713aa7c465c8df93c ]

The backward sweep in mlx4_cq_clean() used:

  while ((int) --prod_index - (int) cq->cons_index >= 0)

Both operands are uint32_t.  Promoting them to int and then subtracting
is undefined behaviour when the result overflows (C11 §6.5p5).  GCC and
Clang exploit that UB: they fold "(int)a - (int)b >= 0" into the plain
signed compare "(int)a >= (int)b", which has no exit when cons_index is
0x80000000 (INT_MIN), causing an infinite loop with the CQ spinlock held.

Replace with a plain unsigned equality check — identical fix to the one
applied to providers/mlx5/cq.c:

  while (prod_index != cq->cons_index) { --prod_index; ... }

prod_index starts at the value found by the forward scan, which begins
at cons_index and only increments, so prod_index >= cons_index always
holds.  Decrementing prod_index each iteration reaches cons_index in
exactly (prod_index - cons_index) steps.  No arithmetic on the loop
condition, no signed casts, no compiler-visible UB.

Fixes: 3e44e8d14a32 ("Implement mlx4_cq_clean()")
Signed-off-by: Yishai Hadas <yishaih@nvidia.com>
Signed-off-by: Nicolas Morey <nmorey@suse.com>