lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

[IB] mthca: Fix off by one bug in mthca_map_cmd

Browse Source 
The loop in mthca_map_cmd() would fill one entry past the end of the
mailbox buffer before calling the firmware command.

Signed-off-by: Michael S. Tsirkin <mst@mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
This commit is contained in:
Michael S. Tsirkin
2005-09-26 09:42:09 -07:00
committed by Roland Dreier
parent f7ed3a5971
commit 44dd823b00
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/infiniband/hw/mthca/mthca_cmd.c
View File

@@ -605,7 +605,7 @@ static int mthca_map_cmd(struct mthca_dev *dev, u16 op, struct mthca_icm *icm,
err = -EINVAL; err = -EINVAL;
goto out; goto out;
} }
for (i = 0; i < mthca_icm_size(&iter) / (1 << lg); ++i, ++nent) { for (i = 0; i < mthca_icm_size(&iter) / (1 << lg); ++i) {
if (virt != -1) { if (virt != -1) {
pages[nent * 2] = cpu_to_be64(virt); pages[nent * 2] = cpu_to_be64(virt);
virt += 1 << lg; virt += 1 << lg;
@@ -616,7 +616,7 @@ static int mthca_map_cmd(struct mthca_dev *dev, u16 op, struct mthca_icm *icm,
ts += 1 << (lg - 10); ts += 1 << (lg - 10);
++tc; ++tc;
if (nent == MTHCA_MAILBOX_SIZE / 16) { if (++nent == MTHCA_MAILBOX_SIZE / 16) {
err = mthca_cmd(dev, mailbox->dma, nent, 0, op, err = mthca_cmd(dev, mailbox->dma, nent, 0, op,
CMD_TIME_CLASS_B, status); CMD_TIME_CLASS_B, status);
if (err || *status) if (err || *status)