mlx4_core: fix mtt range deallocation

The mtt range was allocated in mtt units but deallocated
in segments. Among the rest, this caused crash during hotplug removal

Reported-by: Yinghai Lu <yinghai@kernel.org>
Signed-off-by: Marcel Apfelbaum <marcela@mellanox.co.il>
Reviewed-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
Tested-by: Yinghai Lu <yinghai@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 2 insertions, 2 deletions

diff --git a/drivers/net/ethernet/mellanox/mlx4/mr.c b/drivers/net/ethernet/mellanox/mlx4/mr.c
index f7243b26bdf5..01df5567e16e 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mr.c
+++ b/drivers/net/ethernet/mellanox/mlx4/mr.c
@@ -239,8 +239,8 @@ void __mlx4_free_mtt_range(struct mlx4_dev *dev, u32 offset, int order)
         first_seg = offset / (1 << log_mtts_per_seg);
 
         mlx4_buddy_free(&mr_table->mtt_buddy, first_seg, seg_order);
-        mlx4_table_put_range(dev, &mr_table->mtt_table, first_seg,
-                             first_seg + (1 << seg_order) - 1);
+        mlx4_table_put_range(dev, &mr_table->mtt_table, offset,
+                             offset + (1 << order) - 1);
 }
 
 static void mlx4_free_mtt_range(struct mlx4_dev *dev, u32 offset, int order)