From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Dan Carpenter <dan.carpenter@oracle.com>,
Jon Mason <jon.mason@intel.com>
Subject: [ 13/21] NTB: fix pointer math issues
Date: Wed, 22 May 2013 15:10:31 -0700 [thread overview]
Message-ID: <20130522205234.156185697@linuxfoundation.org> (raw)
In-Reply-To: <20130522205232.597066680@linuxfoundation.org>
3.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
commit cc0f868d8adef7bdc12cda132654870086d766bc upstream.
->remote_rx_info and ->rx_info are struct ntb_rx_info pointers. If we
add sizeof(struct ntb_rx_info) then it goes too far.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jon Mason <jon.mason@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/ntb/ntb_transport.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/ntb/ntb_transport.c
+++ b/drivers/ntb/ntb_transport.c
@@ -486,7 +486,7 @@ static void ntb_transport_setup_qp_mw(st
(qp_num / NTB_NUM_MW * rx_size);
rx_size -= sizeof(struct ntb_rx_info);
- qp->rx_buff = qp->remote_rx_info + sizeof(struct ntb_rx_info);
+ qp->rx_buff = qp->remote_rx_info + 1;
qp->rx_max_frame = min(transport_mtu, rx_size);
qp->rx_max_entry = rx_size / qp->rx_max_frame;
qp->rx_index = 0;
@@ -780,7 +780,7 @@ static void ntb_transport_init_queue(str
(qp_num / NTB_NUM_MW * tx_size);
tx_size -= sizeof(struct ntb_rx_info);
- qp->tx_mw = qp->rx_info + sizeof(struct ntb_rx_info);
+ qp->tx_mw = qp->rx_info + 1;
qp->tx_max_frame = min(transport_mtu, tx_size);
qp->tx_max_entry = tx_size / qp->tx_max_frame;
qp->tx_index = 0;
next prev parent reply other threads:[~2013-05-22 22:14 UTC|newest]
Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-05-22 22:10 [ 00/21] 3.9.4-stable review Greg Kroah-Hartman
2013-05-22 22:10 ` [ 01/21] arm64: debug: clear mdscr_el1 instead of taking the OS lock Greg Kroah-Hartman
2013-05-22 22:10 ` [ 02/21] arm64: mm: Fix operands of clz in __flush_dcache_all Greg Kroah-Hartman
2013-05-22 22:10 ` [ 03/21] btrfs: dont stop searching after encountering the wrong item Greg Kroah-Hartman
2013-05-22 22:10 ` [ 04/21] hwmon: fix error return code in abituguru_probe() Greg Kroah-Hartman
2013-05-22 22:10 ` [ 05/21] i2c: designware: fix RX FIFO overrun Greg Kroah-Hartman
2013-05-22 22:10 ` [ 06/21] i2c: designware: always clear interrupts before enabling them Greg Kroah-Hartman
2013-05-22 22:10 ` [ 07/21] x86: Fix bit corruption at CPU resume time Greg Kroah-Hartman
2013-05-22 22:10 ` [ 08/21] drm/nouveau/bios: fix thinko in ZM_MASK_ADD opcode Greg Kroah-Hartman
2013-05-22 22:10 ` [ 09/21] drm/radeon: Fix VRAM size calculation for VRAM >= 4GB Greg Kroah-Hartman
2013-05-22 22:10 ` [ 10/21] virtio_console: fix uapi header Greg Kroah-Hartman
2013-05-22 22:10 ` [ 11/21] NTB: variable dereferenced before check Greg Kroah-Hartman
2013-05-22 22:10 ` [ 12/21] ntb: off by one sanity checks Greg Kroah-Hartman
2013-05-22 22:10 ` Greg Kroah-Hartman [this message]
2013-05-22 22:10 ` [ 14/21] NTB: Handle 64bit BAR sizes Greg Kroah-Hartman
2013-05-22 22:10 ` [ 15/21] NTB: Link toggle memory leak Greg Kroah-Hartman
2013-05-22 22:10 ` [ 16/21] NTB: reset tx_index on link toggle Greg Kroah-Hartman
2013-05-22 22:10 ` [ 17/21] NTB: Correctly handle receive buffers of the minimal size Greg Kroah-Hartman
2013-05-22 22:10 ` [ 18/21] NTB: memcpy lockup workaround Greg Kroah-Hartman
2013-05-22 22:10 ` [ 19/21] ntb_netdev: remove from list on exit Greg Kroah-Hartman
2013-05-22 22:10 ` [ 20/21] NTB: Multiple NTB client fix Greg Kroah-Hartman
2013-05-22 22:10 ` [ 21/21] x86, vm86: fix VM86 syscalls: use SYSCALL_DEFINEx(...) Greg Kroah-Hartman
2013-05-24 11:13 ` Satoru Takeuchi
2013-05-23 16:52 ` [ 00/21] 3.9.4-stable review Shuah Khan
2013-05-23 16:52 ` Shuah Khan
2013-05-23 16:57 ` Greg Kroah-Hartman
2013-05-24 11:46 ` Satoru Takeuchi
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20130522205234.156185697@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=dan.carpenter@oracle.com \
--cc=jon.mason@intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.