Author: cem
Date: Wed Nov 11 18:56:21 2015
New Revision: 290688
URL: https://svnweb.freebsd.org/changeset/base/290688
Log:
if_ntb: MFV c92ba3c5: invalid buf pointer in multi-MW setups
Order of operations issue with the QP Num and MW count, which would
result in the receive buffer pointer being invalid if there are more
than 1 MW. Corrected with parenthesis to enforce the proper order of
operations.
Reported by: John I. Kading <john.kad...@gd-ms.com>
Reported by: Conrad Meyer <c...@freebsd.org>
Authored by: Jon Mason <jdma...@kudzu.us>
Obtained from: Linux (Dual BSD/GPL driver)
Sponsored by: EMC / Isilon Storage Division
Modified:
head/sys/dev/ntb/if_ntb/if_ntb.c
Modified: head/sys/dev/ntb/if_ntb/if_ntb.c
==============================================================================
--- head/sys/dev/ntb/if_ntb/if_ntb.c Wed Nov 11 18:56:11 2015
(r290687)
+++ head/sys/dev/ntb/if_ntb/if_ntb.c Wed Nov 11 18:56:21 2015
(r290688)
@@ -680,7 +680,7 @@ ntb_transport_init_queue(struct ntb_tran
mw_size = mw->phys_size;
tx_size = mw_size / num_qps_mw;
- qp_offset = tx_size * qp_num / mw_count;
+ qp_offset = tx_size * (qp_num / mw_count);
qp->tx_mw = mw->vbase + qp_offset;
KASSERT(qp->tx_mw != NULL, ("uh oh?"));
@@ -1374,7 +1374,7 @@ ntb_transport_setup_qp_mw(struct ntb_tra
num_qps_mw = nt->qp_count / mw_count;
rx_size = mw->xlat_size / num_qps_mw;
- qp->rx_buff = mw->virt_addr + rx_size * qp_num / mw_count;
+ qp->rx_buff = mw->virt_addr + rx_size * (qp_num / mw_count);
rx_size -= sizeof(struct ntb_rx_info);
qp->remote_rx_info = (void*)(qp->rx_buff + rx_size);
_______________________________________________
svn-src-head@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"
