]> git.proxmox.com Git - mirror_ubuntu-eoan-kernel.git/commitdiff
NTB: invalid buf pointer in multi-MW setups
authorJon Mason <jdmason@kudzu.us>
Mon, 5 Oct 2015 02:54:22 +0000 (22:54 -0400)
committerJon Mason <jdmason@kudzu.us>
Sun, 8 Nov 2015 21:11:21 +0000 (16:11 -0500)
Order of operations issue with the QP Num and MW count, which would
result in the receive buffer pointer being invalid if there are more
than 1 MW.  Corrected with parenthesis to enforce the proper order of
operations.

Reported-by: John I. Kading <John.Kading@gd-ms.com>
Signed-off-by: Jon Mason <jdmason@kudzu.us>
drivers/ntb/ntb_transport.c

index 27b96ae8b1919ac851a8c12e16d55389137606ae..be9389599e75040787e6aae686875d086340ee1f 100644 (file)
@@ -605,7 +605,7 @@ static int ntb_transport_setup_qp_mw(struct ntb_transport_ctx *nt,
                num_qps_mw = qp_count / mw_count;
 
        rx_size = (unsigned int)mw->xlat_size / num_qps_mw;
-       qp->rx_buff = mw->virt_addr + rx_size * qp_num / mw_count;
+       qp->rx_buff = mw->virt_addr + rx_size * (qp_num / mw_count);
        rx_size -= sizeof(struct ntb_rx_info);
 
        qp->remote_rx_info = qp->rx_buff + rx_size;
@@ -956,7 +956,7 @@ static int ntb_transport_init_queue(struct ntb_transport_ctx *nt,
        mw_size = nt->mw_vec[mw_num].phys_size;
 
        tx_size = (unsigned int)mw_size / num_qps_mw;
-       qp_offset = tx_size * qp_num / mw_count;
+       qp_offset = tx_size * (qp_num / mw_count);
 
        qp->tx_mw = nt->mw_vec[mw_num].vbase + qp_offset;
        if (!qp->tx_mw)