It was pointed out to me that comparing tx_tail and tx_head directly
is not safe, since they're unsigned ints that will eventually wrap.
Therefore we need to take their difference as signed ints and check that.
Does this look right? Did I miss any other spots?
- R.
Index: infiniband/ulp/ipoib/ipoib_ib.c
===================================================================
--- infiniband/ulp/ipoib/ipoib_ib.c (revision 2710)
+++ infiniband/ulp/ipoib/ipoib_ib.c (working copy)
@@ -82,7 +82,7 @@ void ipoib_free_ah(struct kref *kref)
unsigned long flags;
- if (ah->last_send <= priv->tx_tail) {
+ if ((int) priv->tx_tail - (int) ah->last_send >= 0) {
ipoib_dbg(priv, "Freeing ah %p\n", ah->ah);
ib_destroy_ah(ah->ah);
kfree(ah);
@@ -356,7 +356,7 @@ static void __ipoib_reap_ah(struct net_d
spin_lock_irq(&priv->lock);
list_for_each_entry_safe(ah, tah, &priv->dead_ahs, list)
- if (ah->last_send <= priv->tx_tail) {
+ if ((int) priv->tx_tail - (int) ah->last_send >= 0) {
list_del(&ah->list);
list_add_tail(&ah->list, &remove_list);
}
@@ -487,7 +487,7 @@ int ipoib_ib_dev_stop(struct net_device
* assume the HW is wedged and just free up
* all our pending work requests.
*/
- while (priv->tx_tail < priv->tx_head) {
+ while ((int) priv->tx_tail - (int) priv->tx_head < 0) {
tx_req = &priv->tx_ring[priv->tx_tail &
(IPOIB_TX_RING_SIZE -
1)];
dma_unmap_single(priv->ca->dma_device,
_______________________________________________
openib-general mailing list
openib-general@openib.org
http://openib.org/mailman/listinfo/openib-general
To unsubscribe, please visit http://openib.org/mailman/listinfo/openib-general
