mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-16 07:35:14 +00:00
[IB] mthca: Fix off by one bug in mthca_map_cmd
The loop in mthca_map_cmd() would fill one entry past the end of the mailbox buffer before calling the firmware command. Signed-off-by: Michael S. Tsirkin <mst@mellanox.co.il> Signed-off-by: Roland Dreier <rolandd@cisco.com>
This commit is contained in:
parent
f7ed3a5971
commit
44dd823b00
1 changed files with 2 additions and 2 deletions
|
@ -605,7 +605,7 @@ static int mthca_map_cmd(struct mthca_dev *dev, u16 op, struct mthca_icm *icm,
|
||||||
err = -EINVAL;
|
err = -EINVAL;
|
||||||
goto out;
|
goto out;
|
||||||
}
|
}
|
||||||
for (i = 0; i < mthca_icm_size(&iter) / (1 << lg); ++i, ++nent) {
|
for (i = 0; i < mthca_icm_size(&iter) / (1 << lg); ++i) {
|
||||||
if (virt != -1) {
|
if (virt != -1) {
|
||||||
pages[nent * 2] = cpu_to_be64(virt);
|
pages[nent * 2] = cpu_to_be64(virt);
|
||||||
virt += 1 << lg;
|
virt += 1 << lg;
|
||||||
|
@ -616,7 +616,7 @@ static int mthca_map_cmd(struct mthca_dev *dev, u16 op, struct mthca_icm *icm,
|
||||||
ts += 1 << (lg - 10);
|
ts += 1 << (lg - 10);
|
||||||
++tc;
|
++tc;
|
||||||
|
|
||||||
if (nent == MTHCA_MAILBOX_SIZE / 16) {
|
if (++nent == MTHCA_MAILBOX_SIZE / 16) {
|
||||||
err = mthca_cmd(dev, mailbox->dma, nent, 0, op,
|
err = mthca_cmd(dev, mailbox->dma, nent, 0, op,
|
||||||
CMD_TIME_CLASS_B, status);
|
CMD_TIME_CLASS_B, status);
|
||||||
if (err || *status)
|
if (err || *status)
|
||||||
|
|
Loading…
Reference in a new issue