linux-kernel-test/drivers/infiniband/hw/mlx4
Roland Dreier 3ae15e1623 IB/mlx4: Fix off-by-one errors in calls to mlx4_ib_free_cq_buf()
When I merged bbf8eed1 ("IB/mlx4: Add support for resizing CQs") I
changed things around so that mlx4_ib_alloc_cq_buf() and
mlx4_ib_free_cq_buf() were used everywhere they could be.  However, I
screwed up the number of entries passed into mlx4_ib_alloc_cq_buf()
in a couple places -- the function bumps the number of entries
internally, so the caller shouldn't add 1 as well.

Passing a too-big value for the number of entries to mlx4_ib_free_cq_buf()
can cause the cleanup to go off the end of an array and corrupt
allocator state in interesting ways.

Signed-off-by: Roland Dreier <rolandd@cisco.com>
2008-04-30 19:52:55 -07:00
..
ah.c IB/mlx4: Add a driver Mellanox ConnectX InfiniBand adapters 2007-05-08 18:00:38 -07:00
cq.c IB/mlx4: Fix off-by-one errors in calls to mlx4_ib_free_cq_buf() 2008-04-30 19:52:55 -07:00
doorbell.c IB: expand ib_umem_get() prototype 2008-04-29 08:06:12 -07:00
Kconfig IB: Use menuconfig for InfiniBand menu 2007-07-09 20:12:26 -07:00
mad.c IB/mlx4: Convert "if(foo)" to "if (foo)" 2008-04-16 21:01:04 -07:00
main.c mlx4_core: Move kernel doorbell management into core 2008-04-23 11:55:45 -07:00
Makefile IB/mlx4: Add a driver Mellanox ConnectX InfiniBand adapters 2007-05-08 18:00:38 -07:00
mlx4_ib.h mlx4_core: Move kernel doorbell management into core 2008-04-23 11:55:45 -07:00
mr.c IB: expand ib_umem_get() prototype 2008-04-29 08:06:12 -07:00
qp.c IB: expand ib_umem_get() prototype 2008-04-29 08:06:12 -07:00
srq.c IB: expand ib_umem_get() prototype 2008-04-29 08:06:12 -07:00
user.h IB/mlx4: Handle new FW requirement for send request prefetching 2007-06-18 08:13:48 -07:00