Commit bf74c747 authored by Michael S. Tsirkin's avatar Michael S. Tsirkin Committed by Roland Dreier

IB/mthca: Fix mthca_array_clear() thinko

mthca_array_clear() does not clear the slot if the used count is
positive. This leads to crashes in mthca_qp_event() since that uses
mthca_array_get() to check that the qp is valid.

Discovered by Ali Ayoub.
Signed-off-by: default avatarMichael S. Tsirkin <mst@mellanox.co.il>
Signed-off-by: default avatarRoland Dreier <rolandd@cisco.com>
parent 3f2792ff
...@@ -144,7 +144,9 @@ void mthca_array_clear(struct mthca_array *array, int index) ...@@ -144,7 +144,9 @@ void mthca_array_clear(struct mthca_array *array, int index)
if (--array->page_list[p].used == 0) { if (--array->page_list[p].used == 0) {
free_page((unsigned long) array->page_list[p].page); free_page((unsigned long) array->page_list[p].page);
array->page_list[p].page = NULL; array->page_list[p].page = NULL;
} } else
array->page_list[p].page[index & (PAGE_SIZE /
sizeof (void *) - 1)] = NULL;
if (array->page_list[p].used < 0) if (array->page_list[p].used < 0)
pr_debug("Array %p index %d page %d with ref count %d < 0\n", pr_debug("Array %p index %d page %d with ref count %d < 0\n",
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment