forked from Minki/linux
IB/ipath: ipath_skip_sge() can break if num_sge > 1
ipath_skip_sge() doesn't exactly duplicate the side effects of ipath_copy_sge() if num_sge > 1 since it doesn't decrement ss->num_sge. This could result in the sg_list being accessed out of bounds. Since ipath_skip_sge() is almost always called with num_sge == 1, the original "optimization" is almost never used. Signed-off-by: Ralph Campbell <ralph.campbell@qlogic.com> Signed-off-by: Roland Dreier <rolandd@cisco.com>
This commit is contained in:
parent
c9f79bdc21
commit
16c59419a0
@ -191,10 +191,6 @@ void ipath_skip_sge(struct ipath_sge_state *ss, u32 length)
|
||||
{
|
||||
struct ipath_sge *sge = &ss->sge;
|
||||
|
||||
while (length > sge->sge_length) {
|
||||
length -= sge->sge_length;
|
||||
ss->sge = *ss->sg_list++;
|
||||
}
|
||||
while (length) {
|
||||
u32 len = sge->length;
|
||||
|
||||
|
Loading…
Reference in New Issue
Block a user