diff options
author | Michael S. Tsirkin <mst@mellanox.co.il> | 2006-07-26 13:02:53 (GMT) |
---|---|---|
committer | Roland Dreier <rolandd@cisco.com> | 2006-08-03 16:44:21 (GMT) |
commit | bf74c7479ef47652005a2418eeb0d867451690da (patch) | |
tree | 699942351b2ef37285578a777fb86e7b1119ad18 /drivers/infiniband | |
parent | 3f2792ffbd88dc1cd41d226674cc428914981e98 (diff) | |
download | linux-bf74c7479ef47652005a2418eeb0d867451690da.tar.xz |
IB/mthca: Fix mthca_array_clear() thinko
mthca_array_clear() does not clear the slot if the used count is
positive. This leads to crashes in mthca_qp_event() since that uses
mthca_array_get() to check that the qp is valid.
Discovered by Ali Ayoub.
Signed-off-by: Michael S. Tsirkin <mst@mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
Diffstat (limited to 'drivers/infiniband')
-rw-r--r-- | drivers/infiniband/hw/mthca/mthca_allocator.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/infiniband/hw/mthca/mthca_allocator.c b/drivers/infiniband/hw/mthca/mthca_allocator.c index 9ba3211..848e583 100644 --- a/drivers/infiniband/hw/mthca/mthca_allocator.c +++ b/drivers/infiniband/hw/mthca/mthca_allocator.c @@ -144,7 +144,9 @@ void mthca_array_clear(struct mthca_array *array, int index) if (--array->page_list[p].used == 0) { free_page((unsigned long) array->page_list[p].page); array->page_list[p].page = NULL; - } + } else + array->page_list[p].page[index & (PAGE_SIZE / + sizeof (void *) - 1)] = NULL; if (array->page_list[p].used < 0) pr_debug("Array %p index %d page %d with ref count %d < 0\n", |