Commit ab396eb0 authored Oct 12, 2008 by Dimitris Michailidis Committed by David S. Miller Oct 12, 2008

net: Fix off-by-one in skb_dma_map



The unwind loop iterates down to -1 instead of stopping at 0 and ends up
accessing ->frags[-1].

Signed-off-by: Dimitris Michailidis <dm@chelsio.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent c6dcb827

net/core/skb_dma_map.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -35,7 +35,7 @@ int skb_dma_map(struct device dev, struct sk_buff skb,
		return 0;

		unwind:
		while (i-- >= 0) {
		while (--i >= 0) {
		skb_frag_t *fp = &sp->frags[i];

		dma_unmap_page(dev, sp->dma_maps[i + 1],