[PATCH] cxgb3i: fix ddp map overrun
From: Karen Xie <k...@chelsio.com>
Fixed a bug in calculating ddp map range when search for free entries:
it was going beyond the end by one, thus corrupting gl_skb[0].
Signed-off-by: Karen Xie <k...@chelsio.com>
---
drivers/scsi/cxgb3i/cxgb3i_ddp.c | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/scsi/cxgb3i/cxgb3i_ddp.c b/drivers/scsi/cxgb3i/cxgb3i_ddp.c
index d06a661..43f6ece 100644
--- a/drivers/scsi/cxgb3i/cxgb3i_ddp.c
+++ b/drivers/scsi/cxgb3i/cxgb3i_ddp.c
@@ -367,7 +367,7 @@ int cxgb3i_ddp_tag_reserve(struct t3cdev *tdev, unsigned
int tid,
}
npods = (gl->nelem + PPOD_PAGES_MAX - 1) >> PPOD_PAGES_SHIFT;
- idx_max = ddp->nppods - npods + 1;
+ idx_max = ddp->nppods - npods;
if (ddp->idx_last == ddp->nppods)
idx = ddp_find_unused_entries(ddp, 0, idx_max, npods, gl);
@@ -376,7 +376,7 @@ int cxgb3i_ddp_tag_reserve(struct t3cdev *tdev, unsigned
int tid,
idx_max, npods, gl);
if (idx < 0 && ddp->idx_last >= npods)
idx = ddp_find_unused_entries(ddp, 0,
- ddp->idx_last - npods + 1,
+ ddp->idx_last + npods - 1,
npods, gl);
}
if (idx < 0) {
--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the Google Groups
"open-iscsi" group.
To post to this group, send email to open-iscsi@googlegroups.com
To unsubscribe from this group, send email to
open-iscsi+unsubscr...@googlegroups.com
For more options, visit this group at http://groups.google.com/group/open-iscsi
-~----------~----~----~----~------~----~------~--~---
