On Thu, Dec 17, 2015 at 02:00:18AM -0500, ira.weiny@xxxxxxxxx wrote: > From: Mitko Haralanov <mitko.haralanov@xxxxxxxxx> > +static int unprogram_rcvarray(struct file *fp, u32 tidinfo, > + struct tid_group **grp) > +{ > + struct hfi1_filedata *fd = fp->private_data; > + struct hfi1_ctxtdata *uctxt = fd->uctxt; > + struct hfi1_devdata *dd = uctxt->dd; > + struct mmu_rb_node *node; > + u8 tidctrl = EXP_TID_GET(tidinfo, CTRL); > + u32 tidbase = uctxt->expected_base, > + tididx = EXP_TID_GET(tidinfo, IDX) << 1, rcventry; > + > + if (tididx > uctxt->expected_count) { Should this be >= ? I don't think it makes that much difference since we're not using it as an offset. > + dd_dev_err(dd, "Invalid RcvArray entry (%u) index for ctxt %u\n", > + tididx, uctxt->ctxt); > + return -EINVAL; > + } > + > + if (tidctrl == 0x3) > + return -EINVAL; > + > + rcventry = tidbase + tididx + (tidctrl - 1); > + > + spin_lock(&fd->rb_lock); > + node = mmu_rb_search_by_entry(&fd->tid_rb_root, rcventry); > + if (!node) { > + spin_unlock(&fd->rb_lock); > + return -EBADF; > + } > + rb_erase(&node->rbnode, &fd->tid_rb_root); > + spin_unlock(&fd->rb_lock); > + if (grp) > + *grp = node->grp; > + clear_tid_node(fd, fd->subctxt, node); > + return 0; > +} regards, dan carpenter _______________________________________________ devel mailing list devel@xxxxxxxxxxxxxxxxxxxxxx http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel