From: Jon Mason <jdmason@kudzu.us>
Date: Fri, 18 Dec 2015 18:22:37 +0000 (-0500)
Subject: NTB: ntb_process_tx error path bug
X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=179f912a39ac192d2281ecb10a66918ee20f5d73;p=GitHub%2FLineageOS%2Fandroid_kernel_motorola_exynos9610.git

NTB: ntb_process_tx error path bug

The transmit overrun avoidance error path in ntb_process_tx accidentally
swapped the first two values being passed to the tx_handler client.
This could result in crashes in the ntb_netdev (or other out-of-tree NTB
clients).

Reported-by: Alex Depoutovitch <alex@pernixdata.com>
Signed-off-by: Jon Mason <jdmason@kudzu.us>
---

diff --git a/drivers/ntb/ntb_transport.c b/drivers/ntb/ntb_transport.c
index 60654d524858..bd1bcb323128 100644
--- a/drivers/ntb/ntb_transport.c
+++ b/drivers/ntb/ntb_transport.c
@@ -1532,7 +1532,7 @@ static int ntb_process_tx(struct ntb_transport_qp *qp,
 
 	if (entry->len > qp->tx_max_frame - sizeof(struct ntb_payload_header)) {
 		if (qp->tx_handler)
-			qp->tx_handler(qp->cb_data, qp, NULL, -EIO);
+			qp->tx_handler(qp, qp->cb_data, NULL, -EIO);
 
 		ntb_list_add(&qp->ntb_tx_free_q_lock, &entry->entry,
 			     &qp->tx_free_q);