Author: cem
Date: Sun Oct 11 20:57:09 2015
New Revision: 289152
URL: https://svnweb.freebsd.org/changeset/base/289152

Log:
  NTB: MFV cc0f868d: fix pointer math issues
  
  ->remote_rx_info and ->rx_info are struct ntb_rx_info pointers.  If we
  add sizeof(struct ntb_rx_info) then it goes too far.
  
  Authored by:  Dan Carpenter
  Obtained from:        Linux
  Sponsored by: EMC / Isilon Storage Division

Modified:
  head/sys/dev/ntb/if_ntb/if_ntb.c

Modified: head/sys/dev/ntb/if_ntb/if_ntb.c
==============================================================================
--- head/sys/dev/ntb/if_ntb/if_ntb.c    Sun Oct 11 20:02:10 2015        
(r289151)
+++ head/sys/dev/ntb/if_ntb/if_ntb.c    Sun Oct 11 20:57:09 2015        
(r289152)
@@ -548,7 +548,7 @@ ntb_transport_init_queue(struct ntb_netd
            (qp_num / NTB_NUM_MW * tx_size));
        tx_size -= sizeof(struct ntb_rx_info);
 
-       qp->tx_mw = qp->rx_info + sizeof(struct ntb_rx_info);
+       qp->tx_mw = qp->rx_info + 1;
        qp->tx_max_frame = min(transport_mtu + sizeof(struct 
ntb_payload_header),
            tx_size);
        qp->tx_max_entry = tx_size / qp->tx_max_frame;
@@ -1148,7 +1148,7 @@ ntb_transport_setup_qp_mw(struct ntb_net
                             (qp_num / NTB_NUM_MW * rx_size));
        rx_size -= sizeof(struct ntb_rx_info);
 
-       qp->rx_buff = qp->remote_rx_info + sizeof(struct ntb_rx_info);
+       qp->rx_buff = qp->remote_rx_info + 1;
        qp->rx_max_frame = min(transport_mtu + sizeof(struct 
ntb_payload_header),
            rx_size);
        qp->rx_max_entry = rx_size / qp->rx_max_frame;
_______________________________________________
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"

Reply via email to