From ab396eb03f33a2e2afb7b0603a43929bf5857c45 Mon Sep 17 00:00:00 2001 From: Dimitris Michailidis Date: Sun, 12 Oct 2008 21:07:34 -0700 Subject: net: Fix off-by-one in skb_dma_map The unwind loop iterates down to -1 instead of stopping at 0 and ends up accessing ->frags[-1]. Signed-off-by: Dimitris Michailidis Signed-off-by: David S. Miller --- net/core/skb_dma_map.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'net/core') diff --git a/net/core/skb_dma_map.c b/net/core/skb_dma_map.c index 1f49afcd8e8..86234923a3b 100644 --- a/net/core/skb_dma_map.c +++ b/net/core/skb_dma_map.c @@ -35,7 +35,7 @@ int skb_dma_map(struct device *dev, struct sk_buff *skb, return 0; unwind: - while (i-- >= 0) { + while (--i >= 0) { skb_frag_t *fp = &sp->frags[i]; dma_unmap_page(dev, sp->dma_maps[i + 1], -- cgit v1.2.3