From: Roland Dreier <rolandd@cisco.com>
Date: Thu, 1 May 2008 02:52:55 +0000 (-0700)
Subject: IB/mlx4: Fix off-by-one errors in calls to mlx4_ib_free_cq_buf()
X-Git-Tag: v2.6.26-rc2~61^2~6
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=3ae15e1623b9d32eb410c2a23d90e47b16e6acd0;p=pandora-kernel.git

IB/mlx4: Fix off-by-one errors in calls to mlx4_ib_free_cq_buf()

When I merged bbf8eed1 ("IB/mlx4: Add support for resizing CQs") I
changed things around so that mlx4_ib_alloc_cq_buf() and
mlx4_ib_free_cq_buf() were used everywhere they could be.  However, I
screwed up the number of entries passed into mlx4_ib_alloc_cq_buf()
in a couple places -- the function bumps the number of entries
internally, so the caller shouldn't add 1 as well.

Passing a too-big value for the number of entries to mlx4_ib_free_cq_buf()
can cause the cleanup to go off the end of an array and corrupt
allocator state in interesting ways.

Signed-off-by: Roland Dreier <rolandd@cisco.com>
---

Reading git-diff-tree failed