[PATCH for-rc 5/7] RDMA/bnxt_re: Reset cqe pointer each poll_cq iteration

[Selvin Xavier <selvin.xavier@broadcom.com>]

In bnxt_re_poll_cq(), cqe advances for every polled CQE, but budget is
decremented only for completions reported to the caller. Skipped CQEs
(looped-back QP1 receive, shadow-QP completions, unknown opcode) leave
cqe ahead of where budget implies, so the next poll can write past the
end of cq->cql[].

cql[] is only scratch space, so reset cqe to the start of the array on
each iteration of the outer loop.

Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver")
Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
---
 drivers/infiniband/hw/bnxt_re/ib_verbs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
index ac15372376a2..796ea795c5b7 100644
--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
@@ -4328,8 +4328,8 @@ int bnxt_re_poll_cq(struct ib_cq *ib_cq, int num_entries, struct ib_wc *wc)
 		ibdev_err(&cq->rdev->ibdev, "POLL CQ : no CQL to use");
 		goto exit;
 	}
-	cqe = &cq->cql[0];
 	while (budget) {
+		cqe = &cq->cql[0];
 		lib_qp = NULL;
 		ncqe = bnxt_qplib_poll_cq(&cq->qplib_cq, cqe, budget, &lib_qp);
 		if (lib_qp) {
-- 
2.39.3