Commit:     841adfca9c5fc0fec6b1f0b2e5eb7a3b239a7730
Parent:     786f238e4f2f0d962831ee3228f2327133eb082a
Author:     Ralph Campbell <[EMAIL PROTECTED]>
AuthorDate: Fri Jun 29 11:37:56 2007 -0700
Committer:  Roland Dreier <[EMAIL PROTECTED]>
CommitDate: Mon Jul 2 20:48:31 2007 -0700

    IPoIB/cm: Partial error clean up unmaps wrong address
    If a page can't be allocated for the frag list of a skb, the code to
    unmap the partially allocated list is off by one.  For exaple, if
    'frags' equals one, i == 0, and the alloc_page() fails, then the old
    loop would have unmapped mapping[1] which is uninitialized.  The same
    would happen if the call to ib_dma_map_page() failed.
    Signed-off-by: Ralph Campbell <[EMAIL PROTECTED]>
    Acked-by: Michael S. Tsirkin <[EMAIL PROTECTED]>
    Signed-off-by: Roland Dreier <[EMAIL PROTECTED]>
 drivers/infiniband/ulp/ipoib/ipoib_cm.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c 
index 5ffc464..ea74d1e 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
@@ -148,8 +148,8 @@ partial_error:
        ib_dma_unmap_single(priv->ca, mapping[0], IPOIB_CM_HEAD_SIZE, 
-       for (; i >= 0; --i)
-               ib_dma_unmap_single(priv->ca, mapping[i + 1], PAGE_SIZE, 
+       for (; i > 0; --i)
+               ib_dma_unmap_single(priv->ca, mapping[i], PAGE_SIZE, 
        return NULL;
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at

Reply via email to