diff options
author | 2008-10-12 21:07:34 -0700 | |
---|---|---|
committer | 2008-10-12 21:07:34 -0700 | |
commit | ab396eb03f33a2e2afb7b0603a43929bf5857c45 (patch) | |
tree | df6bd3b974563d3b5ee1865e7ad34936624cbdfd /net | |
parent | smc911x: Add support for LAN921{5,7,8} chips from SMSC (diff) | |
download | linux-ab396eb03f33a2e2afb7b0603a43929bf5857c45.tar.gz linux-ab396eb03f33a2e2afb7b0603a43929bf5857c45.tar.bz2 linux-ab396eb03f33a2e2afb7b0603a43929bf5857c45.zip |
net: Fix off-by-one in skb_dma_map
The unwind loop iterates down to -1 instead of stopping at 0 and ends up
accessing ->frags[-1].
Signed-off-by: Dimitris Michailidis <dm@chelsio.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
-rw-r--r-- | net/core/skb_dma_map.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/core/skb_dma_map.c b/net/core/skb_dma_map.c index 1f49afcd8e86..86234923a3b7 100644 --- a/net/core/skb_dma_map.c +++ b/net/core/skb_dma_map.c @@ -35,7 +35,7 @@ int skb_dma_map(struct device *dev, struct sk_buff *skb, return 0; unwind: - while (i-- >= 0) { + while (--i >= 0) { skb_frag_t *fp = &sp->frags[i]; dma_unmap_page(dev, sp->dma_maps[i + 1], |