projects / GitHub / LineageOS / android_kernel_motorola_exynos9610.git / commitdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: 3b73e79)
tokenring: Read buffer overflow
authorroel kluin <roel.kluin@gmail.com>
Sat, 25 Jul 2009 12:38:33 +0000 (12:38 +0000)
committerDavid S. Miller <davem@davemloft.net>
Mon, 27 Jul 2009 01:50:39 +0000 (18:50 -0700)
io[i] is read before the bounds check on i, order should be reversed

Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
drivers/net/tokenring/ibmtr.c patch | blob | blame | history

diff --git a/drivers/net/tokenring/ibmtr.c b/drivers/net/tokenring/ibmtr.c
index 9d896116cf761b6aea8a6b294a2da95fa07238f5..08a6c41c1599f067ac8c165ab4c9efab309170b2 100644 (file)
--- a/drivers/net/tokenring/ibmtr.c
+++ b/drivers/net/tokenring/ibmtr.c
@@ -1912,7 +1912,7 @@ static int __init ibmtr_init(void)
 
        find_turbo_adapters(io);
 
-       for (i = 0; io[i] && (i < IBMTR_MAX_ADAPTERS); i++) {
+       for (i = 0; i < IBMTR_MAX_ADAPTERS && io[i]; i++) {
                struct net_device *dev;
                irq[i] = 0;
                mem[i] = 0;