Roland Dreier 3ae15e1623 IB/mlx4: Fix off-by-one errors in calls to mlx4_ib_free_cq_buf()
When I merged bbf8eed1 ("IB/mlx4: Add support for resizing CQs") I
changed things around so that mlx4_ib_alloc_cq_buf() and
mlx4_ib_free_cq_buf() were used everywhere they could be.  However, I
screwed up the number of entries passed into mlx4_ib_alloc_cq_buf()
in a couple places -- the function bumps the number of entries
internally, so the caller shouldn't add 1 as well.

Passing a too-big value for the number of entries to mlx4_ib_free_cq_buf()
can cause the cleanup to go off the end of an array and corrupt
allocator state in interesting ways.

Signed-off-by: Roland Dreier <rolandd@cisco.com>
2008-04-30 19:52:55 -07:00
..
2008-03-13 22:53:29 +01:00
2008-04-21 22:38:45 +00:00
2008-04-29 08:06:27 -07:00
2008-04-29 08:06:27 -07:00
2008-04-29 08:06:18 -07:00
2008-02-26 14:12:09 +09:00
2008-04-28 08:58:31 -07:00
2008-04-23 21:25:35 -04:00
2008-04-29 08:06:28 -07:00
2008-04-07 13:14:22 -07:00
2008-03-04 16:35:12 -08:00
2008-04-24 23:57:33 +02:00
2008-04-24 23:57:33 +02:00