summaryrefslogtreecommitdiff
path: root/drivers/ntb/ntb_transport.c
diff options
context:
space:
mode:
authorJon Mason <jdmason@kudzu.us>2015-10-04 22:54:22 -0400
committerJon Mason <jdmason@kudzu.us>2015-11-08 16:11:21 -0500
commitc92ba3c5d97de59c016d1a23ebab17293a792621 (patch)
treea887ab7f7133b6bce843d3611dc63dba49f0ad8f /drivers/ntb/ntb_transport.c
parent70d4687d60184915b6f40920041caa1df4f4d033 (diff)
NTB: invalid buf pointer in multi-MW setups
Order of operations issue with the QP Num and MW count, which would result in the receive buffer pointer being invalid if there are more than 1 MW. Corrected with parenthesis to enforce the proper order of operations. Reported-by: John I. Kading <John.Kading@gd-ms.com> Signed-off-by: Jon Mason <jdmason@kudzu.us>
Diffstat (limited to 'drivers/ntb/ntb_transport.c')
-rw-r--r--drivers/ntb/ntb_transport.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/ntb/ntb_transport.c b/drivers/ntb/ntb_transport.c
index 27b96ae8b191..be9389599e75 100644
--- a/drivers/ntb/ntb_transport.c
+++ b/drivers/ntb/ntb_transport.c
@@ -605,7 +605,7 @@ static int ntb_transport_setup_qp_mw(struct ntb_transport_ctx *nt,
num_qps_mw = qp_count / mw_count;
rx_size = (unsigned int)mw->xlat_size / num_qps_mw;
- qp->rx_buff = mw->virt_addr + rx_size * qp_num / mw_count;
+ qp->rx_buff = mw->virt_addr + rx_size * (qp_num / mw_count);
rx_size -= sizeof(struct ntb_rx_info);
qp->remote_rx_info = qp->rx_buff + rx_size;
@@ -956,7 +956,7 @@ static int ntb_transport_init_queue(struct ntb_transport_ctx *nt,
mw_size = nt->mw_vec[mw_num].phys_size;
tx_size = (unsigned int)mw_size / num_qps_mw;
- qp_offset = tx_size * qp_num / mw_count;
+ qp_offset = tx_size * (qp_num / mw_count);
qp->tx_mw = nt->mw_vec[mw_num].vbase + qp_offset;
if (!qp->tx_mw)