]> git.baikalelectronics.ru Git - kernel.git/commit
atm: iphase: off by one in rx_pkt()
authorDan Carpenter <dan.carpenter@oracle.com>
Fri, 27 May 2016 10:34:35 +0000 (13:34 +0300)
committerDavid S. Miller <davem@davemloft.net>
Tue, 31 May 2016 18:52:59 +0000 (11:52 -0700)
commite716e3f84899ab1b36c38b7719885925551b8e11
tree7e7a7e03f72c394181ba4feb1ad4752fc78ecef9
parentdc27b955a8b9a9cbdae8a3fda55a5068cce97ad8
atm: iphase: off by one in rx_pkt()

The iadev->rx_open[] array holds "iadev->num_vc" pointers (this code
assumes that pointers are 32 bits).  So the > here should be >= or else
we could end up reading a garbage pointer from one element beyond the
end of the array.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
drivers/atm/iphase.c