diff options
| author | cem <cem@FreeBSD.org> | 2015-11-11 18:56:21 +0000 |
|---|---|---|
| committer | cem <cem@FreeBSD.org> | 2015-11-11 18:56:21 +0000 |
| commit | ca58bba318fd8bdebd40eaa3b4e8bb354887c077 (patch) | |
| tree | ef5863e1a0a671cff88dc60b4272cefcfcb275e8 | |
| parent | 1d18b415e2768656c57426e8824145dc72ec8976 (diff) | |
| download | FreeBSD-src-ca58bba318fd8bdebd40eaa3b4e8bb354887c077.zip FreeBSD-src-ca58bba318fd8bdebd40eaa3b4e8bb354887c077.tar.gz | |
if_ntb: MFV c92ba3c5: invalid buf pointer in multi-MW setups
Order of operations issue with the QP Num and MW count, which would
result in the receive buffer pointer being invalid if there are more
than 1 MW. Corrected with parenthesis to enforce the proper order of
operations.
Reported by: John I. Kading <John.Kading@gd-ms.com>
Reported by: Conrad Meyer <cem@FreeBSD.org>
Authored by: Jon Mason <jdmason@kudzu.us>
Obtained from: Linux (Dual BSD/GPL driver)
Sponsored by: EMC / Isilon Storage Division
| -rw-r--r-- | sys/dev/ntb/if_ntb/if_ntb.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/sys/dev/ntb/if_ntb/if_ntb.c b/sys/dev/ntb/if_ntb/if_ntb.c index 963f433..19490e4 100644 --- a/sys/dev/ntb/if_ntb/if_ntb.c +++ b/sys/dev/ntb/if_ntb/if_ntb.c @@ -680,7 +680,7 @@ ntb_transport_init_queue(struct ntb_transport_ctx *nt, unsigned int qp_num) mw_size = mw->phys_size; tx_size = mw_size / num_qps_mw; - qp_offset = tx_size * qp_num / mw_count; + qp_offset = tx_size * (qp_num / mw_count); qp->tx_mw = mw->vbase + qp_offset; KASSERT(qp->tx_mw != NULL, ("uh oh?")); @@ -1374,7 +1374,7 @@ ntb_transport_setup_qp_mw(struct ntb_transport_ctx *nt, unsigned int qp_num) num_qps_mw = nt->qp_count / mw_count; rx_size = mw->xlat_size / num_qps_mw; - qp->rx_buff = mw->virt_addr + rx_size * qp_num / mw_count; + qp->rx_buff = mw->virt_addr + rx_size * (qp_num / mw_count); rx_size -= sizeof(struct ntb_rx_info); qp->remote_rx_info = (void*)(qp->rx_buff + rx_size); |
