diff options
| author | Roland Dreier <rolandd@cisco.com> | 2008-05-01 04:52:55 +0200 |
|---|---|---|
| committer | Roland Dreier <rolandd@cisco.com> | 2008-05-01 04:52:55 +0200 |
| commit | 3ae15e1623b9d32eb410c2a23d90e47b16e6acd0 (patch) | |
| tree | b1138d36523cc8f0f5b3fae12f81f573eae96997 /drivers/bluetooth | |
| parent | Merge branch 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/gi... (diff) | |
| download | linux-3ae15e1623b9d32eb410c2a23d90e47b16e6acd0.tar.xz linux-3ae15e1623b9d32eb410c2a23d90e47b16e6acd0.zip | |
IB/mlx4: Fix off-by-one errors in calls to mlx4_ib_free_cq_buf()
When I merged bbf8eed1 ("IB/mlx4: Add support for resizing CQs") I
changed things around so that mlx4_ib_alloc_cq_buf() and
mlx4_ib_free_cq_buf() were used everywhere they could be. However, I
screwed up the number of entries passed into mlx4_ib_alloc_cq_buf()
in a couple places -- the function bumps the number of entries
internally, so the caller shouldn't add 1 as well.
Passing a too-big value for the number of entries to mlx4_ib_free_cq_buf()
can cause the cleanup to go off the end of an array and corrupt
allocator state in interesting ways.
Signed-off-by: Roland Dreier <rolandd@cisco.com>
Diffstat (limited to 'drivers/bluetooth')
0 files changed, 0 insertions, 0 deletions