net: Fix off-by-one in skb_dma_map
authorDimitris Michailidis <dm@chelsio.com>
Mon, 13 Oct 2008 04:07:34 +0000 (21:07 -0700)
committerDavid S. Miller <davem@davemloft.net>
Mon, 13 Oct 2008 04:07:34 +0000 (21:07 -0700)
The unwind loop iterates down to -1 instead of stopping at 0 and ends up
accessing ->frags[-1].

Signed-off-by: Dimitris Michailidis <dm@chelsio.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/core/skb_dma_map.c

index 1f49afcd8e8688c427508903b96f6e83a856fa4a..86234923a3b7600571d434e884fed063a318c718 100644 (file)
@@ -35,7 +35,7 @@ int skb_dma_map(struct device *dev, struct sk_buff *skb,
        return 0;
 
 unwind:
-       while (i-- >= 0) {
+       while (--i >= 0) {
                skb_frag_t *fp = &sp->frags[i];
 
                dma_unmap_page(dev, sp->dma_maps[i + 1],