1. 01 5月, 2008 1 次提交
    • R
      IB/mlx4: Fix off-by-one errors in calls to mlx4_ib_free_cq_buf() · 3ae15e16
      Roland Dreier 提交于
      When I merged bbf8eed1 ("IB/mlx4: Add support for resizing CQs") I
      changed things around so that mlx4_ib_alloc_cq_buf() and
      mlx4_ib_free_cq_buf() were used everywhere they could be.  However, I
      screwed up the number of entries passed into mlx4_ib_alloc_cq_buf()
      in a couple places -- the function bumps the number of entries
      internally, so the caller shouldn't add 1 as well.
      
      Passing a too-big value for the number of entries to mlx4_ib_free_cq_buf()
      can cause the cleanup to go off the end of an array and corrupt
      allocator state in interesting ways.
      Signed-off-by: NRoland Dreier <rolandd@cisco.com>
      3ae15e16
  2. 30 4月, 2008 39 次提交