diff options
| author | Michael S. Tsirkin <mst@mellanox.co.il> | 2005-09-26 09:42:09 -0700 |
|---|---|---|
| committer | Roland Dreier <rolandd@cisco.com> | 2005-09-26 09:42:09 -0700 |
| commit | 44dd823b00fa64bf01e53557d28555011f122a88 (patch) | |
| tree | 7245a298b11123ef81ded5afb92f1c711d643fed | |
| parent | f7ed3a5971da98acdc506bdbdef25cfe51c334a2 (diff) | |
| download | op-kernel-dev-44dd823b00fa64bf01e53557d28555011f122a88.zip op-kernel-dev-44dd823b00fa64bf01e53557d28555011f122a88.tar.gz | |
[IB] mthca: Fix off by one bug in mthca_map_cmd
The loop in mthca_map_cmd() would fill one entry past the end of the
mailbox buffer before calling the firmware command.
Signed-off-by: Michael S. Tsirkin <mst@mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
| -rw-r--r-- | drivers/infiniband/hw/mthca/mthca_cmd.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/infiniband/hw/mthca/mthca_cmd.c b/drivers/infiniband/hw/mthca/mthca_cmd.c index cc758a2..f6a8ac0 100644 --- a/drivers/infiniband/hw/mthca/mthca_cmd.c +++ b/drivers/infiniband/hw/mthca/mthca_cmd.c @@ -605,7 +605,7 @@ static int mthca_map_cmd(struct mthca_dev *dev, u16 op, struct mthca_icm *icm, err = -EINVAL; goto out; } - for (i = 0; i < mthca_icm_size(&iter) / (1 << lg); ++i, ++nent) { + for (i = 0; i < mthca_icm_size(&iter) / (1 << lg); ++i) { if (virt != -1) { pages[nent * 2] = cpu_to_be64(virt); virt += 1 << lg; @@ -616,7 +616,7 @@ static int mthca_map_cmd(struct mthca_dev *dev, u16 op, struct mthca_icm *icm, ts += 1 << (lg - 10); ++tc; - if (nent == MTHCA_MAILBOX_SIZE / 16) { + if (++nent == MTHCA_MAILBOX_SIZE / 16) { err = mthca_cmd(dev, mailbox->dma, nent, 0, op, CMD_TIME_CLASS_B, status); if (err || *status) |
