Commit ab396eb0 authored by Dimitris Michailidis's avatar Dimitris Michailidis Committed by David S. Miller
Browse files

net: Fix off-by-one in skb_dma_map 



The unwind loop iterates down to -1 instead of stopping at 0 and ends up
accessing ->frags[-1].

Signed-off-by: default avatarDimitris Michailidis <dm@chelsio.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent c6dcb827

net/core/skb_dma_map.c

+1 −1
Original line number Diff line number Diff line
@@ -35,7 +35,7 @@ int skb_dma_map(struct device *dev, struct sk_buff *skb, 
	return 0;



unwind:

	while (i-- >= 0) {

	while (--i >= 0) {

		skb_frag_t *fp = &sp->frags[i];



		dma_unmap_page(dev, sp->dma_maps[i + 1],