aboutsummaryrefslogtreecommitdiff
path: root/net/core/skb_dma_map.c
diff options
context:
space:
mode:
authorDimitris Michailidis <dm@chelsio.com>2008-10-12 21:07:34 -0700
committerDavid S. Miller <davem@davemloft.net>2008-10-12 21:07:34 -0700
commitab396eb03f33a2e2afb7b0603a43929bf5857c45 (patch)
treedf6bd3b974563d3b5ee1865e7ad34936624cbdfd /net/core/skb_dma_map.c
parentc6dcb8278876ebf266e2088b0b45b28aa66b7693 (diff)
downloadlinux-2.6.38-lt-ux500-ab396eb03f33a2e2afb7b0603a43929bf5857c45.tar.gz
net: Fix off-by-one in skb_dma_map
The unwind loop iterates down to -1 instead of stopping at 0 and ends up accessing ->frags[-1]. Signed-off-by: Dimitris Michailidis <dm@chelsio.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/core/skb_dma_map.c')
-rw-r--r--net/core/skb_dma_map.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/net/core/skb_dma_map.c b/net/core/skb_dma_map.c
index 1f49afcd8e8..86234923a3b 100644
--- a/net/core/skb_dma_map.c
+++ b/net/core/skb_dma_map.c
@@ -35,7 +35,7 @@ int skb_dma_map(struct device *dev, struct sk_buff *skb,
return 0;
unwind:
- while (i-- >= 0) {
+ while (--i >= 0) {
skb_frag_t *fp = &sp->frags[i];
dma_unmap_page(dev, sp->dma_maps[i + 1],