IB/mlx4: Handle buffer wraparound in __mlx4_ib_cq_clean()

When compacting CQ entries, we need to set the correct value of the
ownership bit in case the value is different between the index we copy
the CQE from and the index we copy it to.

Found by Ronni Zimmerman of Mellanox.

Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>

1 files changed, 9 insertions, 4 deletions

diff --git a/drivers/infiniband/hw/mlx4/cq.c b/drivers/infiniband/hw/mlx4/cq.c
index e940521e9c8d..660b27aecae5 100644
--- a/drivers/infiniband/hw/mlx4/cq.c
+++ b/drivers/infiniband/hw/mlx4/cq.c
@@ -478,7 +478,8 @@ void __mlx4_ib_cq_clean(struct mlx4_ib_cq *cq, u32 qpn, struct mlx4_ib_srq *srq)
 {
         u32 prod_index;
         int nfreed = 0;
-        struct mlx4_cqe *cqe;
+        struct mlx4_cqe *cqe, *dest;
+        u8 owner_bit;
 
         /*
          * First we need to find the current producer index, so we
@@ -501,9 +502,13 @@ void __mlx4_ib_cq_clean(struct mlx4_ib_cq *cq, u32 qpn, struct mlx4_ib_srq *srq)
                         if (srq && !(cqe->owner_sr_opcode & MLX4_CQE_IS_SEND_MASK))
                                 mlx4_ib_free_srq_wqe(srq, be16_to_cpu(cqe->wqe_index));
                         ++nfreed;
-                } else if (nfreed)
-                        memcpy(get_cqe(cq, (prod_index + nfreed) & cq->ibcq.cqe),
-                               cqe, sizeof *cqe);
+                } else if (nfreed) {
+                        dest = get_cqe(cq, (prod_index + nfreed) & cq->ibcq.cqe);
+                        owner_bit = dest->owner_sr_opcode & MLX4_CQE_OWNER_MASK;
+                        memcpy(dest, cqe, sizeof *cqe);
+                        dest->owner_sr_opcode = owner_bit |
+                                (dest->owner_sr_opcode & ~MLX4_CQE_OWNER_MASK);
+                }
         }
 
         if (nfreed) {