summaryrefslogtreecommitdiffstats
path: root/drivers/ntb
diff options
context:
space:
mode:
authorJon Mason <jdmason@kudzu.us>2015-12-18 13:22:37 -0500
committerJon Mason <jdmason@kudzu.us>2016-01-11 09:51:17 -0500
commit179f912a39ac192d2281ecb10a66918ee20f5d73 (patch)
tree54a8f7baa97151e57b1277f4ea581b4beb59dd47 /drivers/ntb
parentafd2ff9b7e1b367172f18ba7f693dfb62bdcb2dc (diff)
downloadlinux-stable-179f912a39ac192d2281ecb10a66918ee20f5d73.tar.gz
linux-stable-179f912a39ac192d2281ecb10a66918ee20f5d73.tar.bz2
linux-stable-179f912a39ac192d2281ecb10a66918ee20f5d73.zip
NTB: ntb_process_tx error path bug
The transmit overrun avoidance error path in ntb_process_tx accidentally swapped the first two values being passed to the tx_handler client. This could result in crashes in the ntb_netdev (or other out-of-tree NTB clients). Reported-by: Alex Depoutovitch <alex@pernixdata.com> Signed-off-by: Jon Mason <jdmason@kudzu.us>
Diffstat (limited to 'drivers/ntb')
-rw-r--r--drivers/ntb/ntb_transport.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/ntb/ntb_transport.c b/drivers/ntb/ntb_transport.c
index 60654d524858..bd1bcb323128 100644
--- a/drivers/ntb/ntb_transport.c
+++ b/drivers/ntb/ntb_transport.c
@@ -1532,7 +1532,7 @@ static int ntb_process_tx(struct ntb_transport_qp *qp,
if (entry->len > qp->tx_max_frame - sizeof(struct ntb_payload_header)) {
if (qp->tx_handler)
- qp->tx_handler(qp->cb_data, qp, NULL, -EIO);
+ qp->tx_handler(qp, qp->cb_data, NULL, -EIO);
ntb_list_add(&qp->ntb_tx_free_q_lock, &entry->entry,
&qp->tx_free_q);