diff options
author | Ralph Campbell <ralph.campbell@qlogic.com> | 2007-06-29 14:37:56 -0400 |
---|---|---|
committer | Roland Dreier <rolandd@cisco.com> | 2007-07-02 23:48:31 -0400 |
commit | 841adfca9c5fc0fec6b1f0b2e5eb7a3b239a7730 (patch) | |
tree | fcdc834ad623a890a0eeb499c41593615746c706 /drivers/infiniband/ulp/ipoib/ipoib_cm.c | |
parent | 786f238e4f2f0d962831ee3228f2327133eb082a (diff) |
IPoIB/cm: Partial error clean up unmaps wrong address
If a page can't be allocated for the frag list of a skb, the code to
unmap the partially allocated list is off by one. For exaple, if
'frags' equals one, i == 0, and the alloc_page() fails, then the old
loop would have unmapped mapping[1] which is uninitialized. The same
would happen if the call to ib_dma_map_page() failed.
Signed-off-by: Ralph Campbell <ralph.campbell@qlogic.com>
Acked-by: Michael S. Tsirkin <mst@dev.mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
Diffstat (limited to 'drivers/infiniband/ulp/ipoib/ipoib_cm.c')
-rw-r--r-- | drivers/infiniband/ulp/ipoib/ipoib_cm.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c index 5ffc464c99aa..ea74d1eaf004 100644 --- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c +++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c | |||
@@ -148,8 +148,8 @@ partial_error: | |||
148 | 148 | ||
149 | ib_dma_unmap_single(priv->ca, mapping[0], IPOIB_CM_HEAD_SIZE, DMA_FROM_DEVICE); | 149 | ib_dma_unmap_single(priv->ca, mapping[0], IPOIB_CM_HEAD_SIZE, DMA_FROM_DEVICE); |
150 | 150 | ||
151 | for (; i >= 0; --i) | 151 | for (; i > 0; --i) |
152 | ib_dma_unmap_single(priv->ca, mapping[i + 1], PAGE_SIZE, DMA_FROM_DEVICE); | 152 | ib_dma_unmap_single(priv->ca, mapping[i], PAGE_SIZE, DMA_FROM_DEVICE); |
153 | 153 | ||
154 | dev_kfree_skb_any(skb); | 154 | dev_kfree_skb_any(skb); |
155 | return NULL; | 155 | return NULL; |