| From cc0f868d8adef7bdc12cda132654870086d766bc Mon Sep 17 00:00:00 2001 |
| From: Dan Carpenter <dan.carpenter@oracle.com> |
| Date: Wed, 23 Jan 2013 22:26:05 +0300 |
| Subject: NTB: fix pointer math issues |
| |
| From: Dan Carpenter <dan.carpenter@oracle.com> |
| |
| commit cc0f868d8adef7bdc12cda132654870086d766bc upstream. |
| |
| ->remote_rx_info and ->rx_info are struct ntb_rx_info pointers. If we |
| add sizeof(struct ntb_rx_info) then it goes too far. |
| |
| Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> |
| Signed-off-by: Jon Mason <jon.mason@intel.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| drivers/ntb/ntb_transport.c | 4 ++-- |
| 1 file changed, 2 insertions(+), 2 deletions(-) |
| |
| --- a/drivers/ntb/ntb_transport.c |
| +++ b/drivers/ntb/ntb_transport.c |
| @@ -486,7 +486,7 @@ static void ntb_transport_setup_qp_mw(st |
| (qp_num / NTB_NUM_MW * rx_size); |
| rx_size -= sizeof(struct ntb_rx_info); |
| |
| - qp->rx_buff = qp->remote_rx_info + sizeof(struct ntb_rx_info); |
| + qp->rx_buff = qp->remote_rx_info + 1; |
| qp->rx_max_frame = min(transport_mtu, rx_size); |
| qp->rx_max_entry = rx_size / qp->rx_max_frame; |
| qp->rx_index = 0; |
| @@ -780,7 +780,7 @@ static void ntb_transport_init_queue(str |
| (qp_num / NTB_NUM_MW * tx_size); |
| tx_size -= sizeof(struct ntb_rx_info); |
| |
| - qp->tx_mw = qp->rx_info + sizeof(struct ntb_rx_info); |
| + qp->tx_mw = qp->rx_info + 1; |
| qp->tx_max_frame = min(transport_mtu, tx_size); |
| qp->tx_max_entry = tx_size / qp->tx_max_frame; |
| qp->tx_index = 0; |
