Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c92ba3c5 authored by Jon Mason's avatar Jon Mason
Browse files

NTB: invalid buf pointer in multi-MW setups 



Order of operations issue with the QP Num and MW count, which would
result in the receive buffer pointer being invalid if there are more
than 1 MW.  Corrected with parenthesis to enforce the proper order of
operations.

Reported-by: default avatarJohn I. Kading <John.Kading@gd-ms.com>
Signed-off-by: default avatarJon Mason <jdmason@kudzu.us>
parent 70d4687d

drivers/ntb/ntb_transport.c

+2 −2
Original line number Diff line number Diff line
@@ -605,7 +605,7 @@ static int ntb_transport_setup_qp_mw(struct ntb_transport_ctx *nt, 
		num_qps_mw = qp_count / mw_count;



	rx_size = (unsigned int)mw->xlat_size / num_qps_mw;

	qp->rx_buff = mw->virt_addr + rx_size * qp_num / mw_count;

	qp->rx_buff = mw->virt_addr + rx_size * (qp_num / mw_count);

	rx_size -= sizeof(struct ntb_rx_info);



	qp->remote_rx_info = qp->rx_buff + rx_size;
@@ -956,7 +956,7 @@ static int ntb_transport_init_queue(struct ntb_transport_ctx *nt, 
	mw_size = nt->mw_vec[mw_num].phys_size;



	tx_size = (unsigned int)mw_size / num_qps_mw;

	qp_offset = tx_size * qp_num / mw_count;

	qp_offset = tx_size * (qp_num / mw_count);



	qp->tx_mw = nt->mw_vec[mw_num].vbase + qp_offset;

	if (!qp->tx_mw)