Techwizz/kernel-fxtec-pro1x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

net: Fix off-by-one in skb_dma_map

Browse source 
The unwind loop iterates down to -1 instead of stopping at 0 and ends up
accessing ->frags[-1].

Signed-off-by: Dimitris Michailidis <dm@chelsio.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Dimitris Michailidis 2008-10-12 21:07:34 -07:00 committed by David S. Miller
parent c6dcb82788
commit ab396eb03f
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
net/core/skb_dma_map.c
View file

@ -35,7 +35,7 @@ int skb_dma_map(struct device *dev, struct sk_buff *skb,
return 0; return 0;
unwind: unwind:
while (i-- >= 0) { while (--i >= 0) {
skb_frag_t *fp = &sp->frags[i]; skb_frag_t *fp = &sp->frags[i];
dma_unmap_page(dev, sp->dma_maps[i + 1], dma_unmap_page(dev, sp->dma_maps[i + 1],