if_ntb: MFV c92ba3c5: invalid buf pointer in multi-MW setups

Order of operations issue with the QP Num and MW count, which would
result in the receive buffer pointer being invalid if there are more
than 1 MW.  Corrected with parenthesis to enforce the proper order of
operations.

Reported by:	John I. Kading <John.Kading@gd-ms.com>
Reported by:	Conrad Meyer <cem@FreeBSD.org>
Authored by:	Jon Mason <jdmason@kudzu.us>
Obtained from:	Linux (Dual BSD/GPL driver)
Sponsored by:	EMC / Isilon Storage Division

diff --git a/sys/dev/ntb/if_ntb/if_ntb.c b/sys/dev/ntb/if_ntb/if_ntb.c
index 963f433ea3875199287c7e20df9296d55ad09bbd..19490e4dcabcf7b63ae656f038acdc326a43bacd 100644 (file)
--- a/sys/dev/ntb/if_ntb/if_ntb.c
+++ b/sys/dev/ntb/if_ntb/if_ntb.c
@@ -680,7 +680,7 @@ ntb_transport_init_queue(struct ntb_transport_ctx *nt, unsigned int qp_num)
        mw_size = mw->phys_size;
 
        tx_size = mw_size / num_qps_mw;
-       qp_offset = tx_size * qp_num / mw_count;
+       qp_offset = tx_size * (qp_num / mw_count);
 
        qp->tx_mw = mw->vbase + qp_offset;
        KASSERT(qp->tx_mw != NULL, ("uh oh?"));
@@ -1374,7 +1374,7 @@ ntb_transport_setup_qp_mw(struct ntb_transport_ctx *nt, unsigned int qp_num)
                num_qps_mw = nt->qp_count / mw_count;
 
        rx_size = mw->xlat_size / num_qps_mw;
-       qp->rx_buff = mw->virt_addr + rx_size * qp_num / mw_count;
+       qp->rx_buff = mw->virt_addr + rx_size * (qp_num / mw_count);
        rx_size -= sizeof(struct ntb_rx_info);
 
        qp->remote_rx_info = (void*)(qp->rx_buff + rx_size);