From: Michael S. Tsirkin <mst@mellanox.co.il>
Date: Wed, 3 Jan 2007 12:46:30 +0000 (+0200)
Subject: IB/mthca: Fix off-by-one in FMR handling on memfree
X-Git-Tag: v2.6.20-rc5~31^2~7
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=46707e96b7254663139225ab6c9ab9922cd8c435;p=pandora-kernel.git

IB/mthca: Fix off-by-one in FMR handling on memfree

mthca_table_find() will return the wrong address when the table entry
being searched for is exactly at the beginning of a sglist entry
(other than the first), because it uses >= when it should use >.

Example: assume we have 2 entries in scatterlist, 4K each, offset is
4K.  The current code will return first entry + 4K when we really want
the second entry.

In particular this means mapping an FMR on a memfree HCA may end up
writing the page table into the wrong place, leading to memory
corruption and also causing the HCA to use an incorrect address
translation table.

Signed-off-by: Michael S. Tsirkin <mst@mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
---

Reading git-diff-tree failed