| Message ID | adavdn53zkw.fsf@cisco.com |
|---|---|
| State | RFC, archived |
| Delegated to: | David Miller |
| Headers | show |
Roland Dreier wrote: > > If mlx4_create_eq() would fail for one of EQ's assigned for > > completion handling, the code would try to free the same EQ > > we failed to create. > > The crash was found by Christoph Lameter > > Thanks, good catch. However looking at the code it seems that a simpler > way to fix this would be as below. Can you confirm that this works too? > --- > drivers/net/mlx4/eq.c | 6 +++--- > 1 files changed, 3 insertions(+), 3 deletions(-) > > diff --git a/drivers/net/mlx4/eq.c b/drivers/net/mlx4/eq.c > index 8830dcb..033817e 100644 > --- a/drivers/net/mlx4/eq.c > +++ b/drivers/net/mlx4/eq.c > @@ -677,12 +677,12 @@ err_out_async: > mlx4_free_eq(dev, &priv->eq_table.eq[dev->caps.num_comp_vectors]); > > err_out_comp: > - i = dev->caps.num_comp_vectors - 1; > + i = dev->caps.num_comp_vectors; > > err_out_unmap: > - while (i >= 0) { > - mlx4_free_eq(dev, &priv->eq_table.eq[i]); > + while (i > 0) { > --i; > + mlx4_free_eq(dev, &priv->eq_table.eq[i]); > } > mlx4_unmap_clr_int(dev); > mlx4_free_irqs(dev); > Yes, it also works Yevgeny -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/drivers/net/mlx4/eq.c b/drivers/net/mlx4/eq.c index 8830dcb..033817e 100644 --- a/drivers/net/mlx4/eq.c +++ b/drivers/net/mlx4/eq.c @@ -677,12 +677,12 @@ err_out_async: mlx4_free_eq(dev, &priv->eq_table.eq[dev->caps.num_comp_vectors]); err_out_comp: - i = dev->caps.num_comp_vectors - 1; + i = dev->caps.num_comp_vectors; err_out_unmap: - while (i >= 0) { - mlx4_free_eq(dev, &priv->eq_table.eq[i]); + while (i > 0) { --i; + mlx4_free_eq(dev, &priv->eq_table.eq[i]); } mlx4_unmap_clr_int(dev); mlx4_free_irqs(dev);