Commit f2633d2e authored May 27, 2016 by Dan Carpenter Committed by David S. Miller May 31, 2016

atm: iphase: off by one in rx_pkt()



The iadev->rx_open[] array holds "iadev->num_vc" pointers (this code
assumes that pointers are 32 bits).  So the > here should be >= or else
we could end up reading a garbage pointer from one element beyond the
end of the array.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 86f04396

drivers/atm/iphase.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -1128,7 +1128,7 @@ static int rx_pkt(struct atm_dev *dev)
		/* make the ptr point to the corresponding buffer desc entry */
		buf_desc_ptr += desc;
		if (!desc \|\| (desc > iadev->num_rx_desc) \|\|
		((buf_desc_ptr->vc_index & 0xffff) > iadev->num_vc)) {
		((buf_desc_ptr->vc_index & 0xffff) >= iadev->num_vc)) {
		free_desc(dev, desc);
		IF_ERR(printk("IA: bad descriptor desc = %d \n", desc);)
		return -1;