diff options
| author | Dimitris Michailidis <dm@chelsio.com> | 2008-10-12 21:07:34 -0700 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2008-10-12 21:07:34 -0700 |
| commit | ab396eb03f33a2e2afb7b0603a43929bf5857c45 (patch) | |
| tree | df6bd3b974563d3b5ee1865e7ad34936624cbdfd /net | |
| parent | c6dcb8278876ebf266e2088b0b45b28aa66b7693 (diff) | |
net: Fix off-by-one in skb_dma_map
The unwind loop iterates down to -1 instead of stopping at 0 and ends up
accessing ->frags[-1].
Signed-off-by: Dimitris Michailidis <dm@chelsio.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
| -rw-r--r-- | net/core/skb_dma_map.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/core/skb_dma_map.c b/net/core/skb_dma_map.c index 1f49afcd8e86..86234923a3b7 100644 --- a/net/core/skb_dma_map.c +++ b/net/core/skb_dma_map.c @@ -35,7 +35,7 @@ int skb_dma_map(struct device *dev, struct sk_buff *skb, return 0; unwind: - while (i-- >= 0) { + while (--i >= 0) { skb_frag_t *fp = &sp->frags[i]; dma_unmap_page(dev, sp->dma_maps[i + 1], |