diff options
| author | Ralph Campbell <ralph.campbell@qlogic.com> | 2007-06-29 22:37:56 +0400 |
|---|---|---|
| committer | Roland Dreier <rolandd@cisco.com> | 2007-07-03 07:48:31 +0400 |
| commit | 841adfca9c5fc0fec6b1f0b2e5eb7a3b239a7730 (patch) | |
| tree | fcdc834ad623a890a0eeb499c41593615746c706 | |
| parent | 786f238e4f2f0d962831ee3228f2327133eb082a (diff) | |
| download | linux-841adfca9c5fc0fec6b1f0b2e5eb7a3b239a7730.tar.xz | |
IPoIB/cm: Partial error clean up unmaps wrong address
If a page can't be allocated for the frag list of a skb, the code to
unmap the partially allocated list is off by one. For exaple, if
'frags' equals one, i == 0, and the alloc_page() fails, then the old
loop would have unmapped mapping[1] which is uninitialized. The same
would happen if the call to ib_dma_map_page() failed.
Signed-off-by: Ralph Campbell <ralph.campbell@qlogic.com>
Acked-by: Michael S. Tsirkin <mst@dev.mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
| -rw-r--r-- | drivers/infiniband/ulp/ipoib/ipoib_cm.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c index 5ffc464c99aa..ea74d1eaf004 100644 --- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c +++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c @@ -148,8 +148,8 @@ partial_error: ib_dma_unmap_single(priv->ca, mapping[0], IPOIB_CM_HEAD_SIZE, DMA_FROM_DEVICE); - for (; i >= 0; --i) - ib_dma_unmap_single(priv->ca, mapping[i + 1], PAGE_SIZE, DMA_FROM_DEVICE); + for (; i > 0; --i) + ib_dma_unmap_single(priv->ca, mapping[i], PAGE_SIZE, DMA_FROM_DEVICE); dev_kfree_skb_any(skb); return NULL; |