]> git.baikalelectronics.ru Git - kernel.git/commit
atm: iphase: off by one in rx_pkt()
authorDan Carpenter <dan.carpenter@oracle.com>
Fri, 27 May 2016 10:34:35 +0000 (13:34 +0300)
committerDavid S. Miller <davem@davemloft.net>
Tue, 31 May 2016 18:52:59 +0000 (11:52 -0700)
commit929b79e284d458006d28f10203371cb9748270e4
tree7e7a7e03f72c394181ba4feb1ad4752fc78ecef9
parent661f28ca8c32d84b30f112f7c9fa5edc23b00b2f
atm: iphase: off by one in rx_pkt()

The iadev->rx_open[] array holds "iadev->num_vc" pointers (this code
assumes that pointers are 32 bits).  So the > here should be >= or else
we could end up reading a garbage pointer from one element beyond the
end of the array.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
drivers/atm/iphase.c