projects / GitHub / moto-9609 / android_kernel_motorola_exynos9610.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 86f0439) | patch
atm: iphase: off by one in rx_pkt()
authorDan Carpenter <dan.carpenter@oracle.com>
Fri, 27 May 2016 10:34:35 +0000 (13:34 +0300)
committerDavid S. Miller <davem@davemloft.net>
Tue, 31 May 2016 18:52:59 +0000 (11:52 -0700)
commitf2633d2eaaab773ea8b29cea3785cf0f8a8872a5
tree7e7a7e03f72c394181ba4feb1ad4752fc78ecef9tree | snapshot (tar.gz zip)
parent86f04396ff6d36146ec335d429191a7c8e2209afcommit | diff
atm: iphase: off by one in rx_pkt()

The iadev->rx_open[] array holds "iadev->num_vc" pointers (this code
assumes that pointers are 32 bits).  So the > here should be >= or else
we could end up reading a garbage pointer from one element beyond the
end of the array.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
drivers/atm/iphase.c diff | blob | blame | history