svn commit: r290688 - head/sys/dev/ntb/if_ntb

[Conrad E. Meyer]

Author: cem
Date: Wed Nov 11 18:56:21 2015
New Revision: 290688
URL: https://svnweb.freebsd.org/changeset/base/290688

Log:
  if_ntb: MFV c92ba3c5: invalid buf pointer in multi-MW setups
  
  Order of operations issue with the QP Num and MW count, which would
  result in the receive buffer pointer being invalid if there are more
  than 1 MW.  Corrected with parenthesis to enforce the proper order of
  operations.
  
  Reported by:	John I. Kading <John.Kading at gd-ms.com>
  Reported by:	Conrad Meyer <cem at FreeBSD.org>
  Authored by:	Jon Mason <jdmason at kudzu.us>
  Obtained from:	Linux (Dual BSD/GPL driver)
  Sponsored by:	EMC / Isilon Storage Division

Modified:
  head/sys/dev/ntb/if_ntb/if_ntb.c

Modified: head/sys/dev/ntb/if_ntb/if_ntb.c
==============================================================================
--- head/sys/dev/ntb/if_ntb/if_ntb.c	Wed Nov 11 18:56:11 2015	(r290687)
+++ head/sys/dev/ntb/if_ntb/if_ntb.c	Wed Nov 11 18:56:21 2015	(r290688)
@@ -680,7 +680,7 @@ ntb_transport_init_queue(struct ntb_tran
 	mw_size = mw->phys_size;
 
 	tx_size = mw_size / num_qps_mw;
-	qp_offset = tx_size * qp_num / mw_count;
+	qp_offset = tx_size * (qp_num / mw_count);
 
 	qp->tx_mw = mw->vbase + qp_offset;
 	KASSERT(qp->tx_mw != NULL, ("uh oh?"));
@@ -1374,7 +1374,7 @@ ntb_transport_setup_qp_mw(struct ntb_tra
 		num_qps_mw = nt->qp_count / mw_count;
 
 	rx_size = mw->xlat_size / num_qps_mw;
-	qp->rx_buff = mw->virt_addr + rx_size * qp_num / mw_count;
+	qp->rx_buff = mw->virt_addr + rx_size * (qp_num / mw_count);
 	rx_size -= sizeof(struct ntb_rx_info);
 
 	qp->remote_rx_info = (void*)(qp->rx_buff + rx_size);