Commit ab396eb0 authored by Dimitris Michailidis's avatar Dimitris Michailidis Committed by David S. Miller

net: Fix off-by-one in skb_dma_map

The unwind loop iterates down to -1 instead of stopping at 0 and ends up
accessing ->frags[-1].
Signed-off-by: default avatarDimitris Michailidis <dm@chelsio.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent c6dcb827
......@@ -35,7 +35,7 @@ int skb_dma_map(struct device *dev, struct sk_buff *skb,
return 0;
unwind:
while (i-- >= 0) {
while (--i >= 0) {
skb_frag_t *fp = &sp->frags[i];
dma_unmap_page(dev, sp->dma_maps[i + 1],
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment