From: Jon Mason Date: Mon, 5 Oct 2015 02:54:22 +0000 (-0400) Subject: NTB: invalid buf pointer in multi-MW setups X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=c92ba3c5d97de59c016d1a23ebab17293a792621;p=GitHub%2Fmoto-9609%2Fandroid_kernel_motorola_exynos9610.git NTB: invalid buf pointer in multi-MW setups Order of operations issue with the QP Num and MW count, which would result in the receive buffer pointer being invalid if there are more than 1 MW. Corrected with parenthesis to enforce the proper order of operations. Reported-by: John I. Kading Signed-off-by: Jon Mason --- diff --git a/drivers/ntb/ntb_transport.c b/drivers/ntb/ntb_transport.c index 27b96ae8b191..be9389599e75 100644 --- a/drivers/ntb/ntb_transport.c +++ b/drivers/ntb/ntb_transport.c @@ -605,7 +605,7 @@ static int ntb_transport_setup_qp_mw(struct ntb_transport_ctx *nt, num_qps_mw = qp_count / mw_count; rx_size = (unsigned int)mw->xlat_size / num_qps_mw; - qp->rx_buff = mw->virt_addr + rx_size * qp_num / mw_count; + qp->rx_buff = mw->virt_addr + rx_size * (qp_num / mw_count); rx_size -= sizeof(struct ntb_rx_info); qp->remote_rx_info = qp->rx_buff + rx_size; @@ -956,7 +956,7 @@ static int ntb_transport_init_queue(struct ntb_transport_ctx *nt, mw_size = nt->mw_vec[mw_num].phys_size; tx_size = (unsigned int)mw_size / num_qps_mw; - qp_offset = tx_size * qp_num / mw_count; + qp_offset = tx_size * (qp_num / mw_count); qp->tx_mw = nt->mw_vec[mw_num].vbase + qp_offset; if (!qp->tx_mw)