diff options
author | Dimitris Michailidis <dm@chelsio.com> | 2008-10-13 04:07:34 (GMT) |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2008-10-13 04:07:34 (GMT) |
commit | ab396eb03f33a2e2afb7b0603a43929bf5857c45 (patch) | |
tree | df6bd3b974563d3b5ee1865e7ad34936624cbdfd /net/core/skb_dma_map.c | |
parent | c6dcb8278876ebf266e2088b0b45b28aa66b7693 (diff) | |
download | linux-fsl-qoriq-ab396eb03f33a2e2afb7b0603a43929bf5857c45.tar.xz |
net: Fix off-by-one in skb_dma_map
The unwind loop iterates down to -1 instead of stopping at 0 and ends up
accessing ->frags[-1].
Signed-off-by: Dimitris Michailidis <dm@chelsio.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/core/skb_dma_map.c')
-rw-r--r-- | net/core/skb_dma_map.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/core/skb_dma_map.c b/net/core/skb_dma_map.c index 1f49afc..8623492 100644 --- a/net/core/skb_dma_map.c +++ b/net/core/skb_dma_map.c @@ -35,7 +35,7 @@ int skb_dma_map(struct device *dev, struct sk_buff *skb, return 0; unwind: - while (i-- >= 0) { + while (--i >= 0) { skb_frag_t *fp = &sp->frags[i]; dma_unmap_page(dev, sp->dma_maps[i + 1], |