IB/hns: Fix a couple pointer math bugs
Subsystems (3)
PATCH 1/2 IB/hns: Fix a couple pointer math bugs
"wqe" is a void pointer so adding sizeof() works. The original code adds sizeof() multiplied by sizeof() so it doesn't work at all.
Fixes 9a4435375cd1 ('IB/hns: Add driver files for hns RoCE driver')
Signed-off-by Dan Carpenter <[email protected]>
drivers/infiniband/hw/hns/hns_roce_hw_v1.c +2 -4
@@ -205,8 +205,7 @@ int hns_roce_v1_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr, (wr->send_flags &IB_SEND_FENCE ? (cpu_to_le32 (HNS_ROCE_WQE_FENCE )) :0 ); - wqe = (struct hns_roce_wqe_ctrl_seg *)wqe + -sizeof (struct hns_roce_wqe_ctrl_seg ); + wqe = wqe +sizeof (struct hns_roce_wqe_ctrl_seg );switch (wr->opcode) {case IB_WR_RDMA_READ :
@@ -235,8 +234,7 @@ int hns_roce_v1_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,break ; } ctrl->flag |=cpu_to_le32 (ps_opcode); - wqe = (struct hns_roce_wqe_raddr_seg *)wqe + -sizeof (struct hns_roce_wqe_raddr_seg ); + wqe = wqe +sizeof (struct hns_roce_wqe_raddr_seg ); dseg = wqe;if (wr->send_flags &IB_SEND_INLINE && wr->num_sge) {
Quoted 31 lines · Dan Carpenter
"wqe" is a void pointer so adding
sizeof()works. The original code addssizeof()multiplied bysizeof()so it doesn't work at all.Fixes 9a4435375cd1 ('IB/hns: Add driver files for hns RoCE driver')Signed-off-by Dan Carpenter <[email protected]>drivers/infiniband/hw/hns/hns_roce_hw_v1.c +2
-4@@ -205,8 +205,7 @@ int hns_roce_v1_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr, (wr->send_flags &IB_SEND_FENCE ? (cpu_to_le32 (HNS_ROCE_WQE_FENCE )) :0 ); - wqe = (struct hns_roce_wqe_ctrl_seg *)wqe + -sizeof (struct hns_roce_wqe_ctrl_seg ); + wqe = wqe +sizeof (struct hns_roce_wqe_ctrl_seg );switch (wr->opcode) {case IB_WR_RDMA_READ :@@ -235,8 +234,7 @@ int hns_roce_v1_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,break ; } ctrl->flag |=cpu_to_le32 (ps_opcode); - wqe = (struct hns_roce_wqe_raddr_seg *)wqe + -sizeof (struct hns_roce_wqe_raddr_seg ); + wqe = wqe +sizeof (struct hns_roce_wqe_raddr_seg ); dseg = wqe;if (wr->send_flags &IB_SEND_INLINE && wr->num_sge) {
Quoted 2 lines
.
Hi, Dan Carpenter
firstly, thanks your reviewing. This quesiton is checked while i develop and test the CM function, and i have fixed it in a patch. the patch
is as follows:
https://patchwork.kernel.org/patch/9334859/
the patch is reviewing by community experts.
thanks your reviewing again.
Thanks
Lijun Ou