Skip to contentSkip to conversation

IB/hns: Fix a couple pointer math bugs

PATCH In review Dan Carpenter 2 participants 2 messages Oct 14, 2016

Subsystems (3)
lore
Share & tools
lore
#0 lore raw

PATCH 1/2 IB/hns: Fix a couple pointer math bugs

"wqe" is a void pointer so adding sizeof() works. The original code adds sizeof() multiplied by sizeof() so it doesn't work at all.

Fixes 9a4435375cd1 ('IB/hns: Add driver files for hns RoCE driver')
drivers/infiniband/hw/hns/hns_roce_hw_v1.c +2 -4
index 399f5de..58b150e 100644
@@ -205,8 +205,7 @@ int hns_roce_v1_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
 				      (wr->send_flags & IB_SEND_FENCE ?
 				      (cpu_to_le32(HNS_ROCE_WQE_FENCE)) : 0);
 
-			wqe = (struct hns_roce_wqe_ctrl_seg *)wqe +
-			       sizeof(struct hns_roce_wqe_ctrl_seg);
+			wqe = wqe + sizeof(struct hns_roce_wqe_ctrl_seg);
 
 			switch (wr->opcode) {
 			case IB_WR_RDMA_READ:
@@ -235,8 +234,7 @@ int hns_roce_v1_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
 				break;
 			}
 			ctrl->flag |= cpu_to_le32(ps_opcode);
-			wqe = (struct hns_roce_wqe_raddr_seg *)wqe +
-			       sizeof(struct hns_roce_wqe_raddr_seg);
+			wqe = wqe + sizeof(struct hns_roce_wqe_raddr_seg);
 
 			dseg = wqe;
 			if (wr->send_flags & IB_SEND_INLINE && wr->num_sge) {
#1 lore raw
Quoted 31 lines · Dan Carpenter

"wqe" is a void pointer so adding sizeof() works. The original code adds sizeof() multiplied by sizeof() so it doesn't work at all.

Fixes 9a4435375cd1 ('IB/hns: Add driver files for hns RoCE driver')
drivers/infiniband/hw/hns/hns_roce_hw_v1.c +2 -4
index 399f5de..58b150e 100644
@@ -205,8 +205,7 @@ int hns_roce_v1_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
 				      (wr->send_flags & IB_SEND_FENCE ?
 				      (cpu_to_le32(HNS_ROCE_WQE_FENCE)) : 0);
 
-			wqe = (struct hns_roce_wqe_ctrl_seg *)wqe +
-			       sizeof(struct hns_roce_wqe_ctrl_seg);
+			wqe = wqe + sizeof(struct hns_roce_wqe_ctrl_seg);
 
 			switch (wr->opcode) {
 			case IB_WR_RDMA_READ:
@@ -235,8 +234,7 @@ int hns_roce_v1_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
 				break;
 			}
 			ctrl->flag |= cpu_to_le32(ps_opcode);
-			wqe = (struct hns_roce_wqe_raddr_seg *)wqe +
-			       sizeof(struct hns_roce_wqe_raddr_seg);
+			wqe = wqe + sizeof(struct hns_roce_wqe_raddr_seg);
 
 			dseg = wqe;
 			if (wr->send_flags & IB_SEND_INLINE && wr->num_sge) {
Quoted 2 lines

.

Hi, Dan Carpenter
firstly, thanks your reviewing. This quesiton is checked while i develop and test the CM function, and i have fixed it in a patch. the patch
is as follows:
https://patchwork.kernel.org/patch/9334859/

the patch is reviewing by community experts.
thanks your reviewing again.

Thanks
Lijun Ou