[ofa-general] [PATCH] IB/mlx4 mlx4_ib: free doorbel fix

[Eli Cohen]

When freeing an entry from order 1, the index field ends up shifted
twice and the resulting index is wrong causing corruption of the
data structure.

Signed-off-by: Eli Cohen <eli at mellanox.co.il>

---

Index: connectx_kernel/drivers/infiniband/hw/mlx4/doorbell.c
===================================================================
--- connectx_kernel.orig/drivers/infiniband/hw/mlx4/doorbell.c	2007-05-06 18:24:54.000000000 +0300
+++ connectx_kernel/drivers/infiniband/hw/mlx4/doorbell.c	2007-05-06 18:29:32.000000000 +0300
@@ -136,9 +136,9 @@ void mlx4_ib_db_free(struct mlx4_ib_dev 
 	if (db->order == 0 && test_bit(i ^ 1, db->u.pgdir->order0)) {
 		clear_bit(i ^ 1, db->u.pgdir->order0);
 		++o;
+		i >>= o;
 	}
 
-	i >>= o;
 	set_bit(i, db->u.pgdir->bits[o]);
 
 	if (bitmap_full(db->u.pgdir->order1, MLX4_IB_DB_PER_PAGE / 2)) {