From: Dimitris Michailidis <dm@chelsio.com>
Date: Mon, 13 Oct 2008 04:07:34 +0000 (-0700)
Subject: net: Fix off-by-one in skb_dma_map
X-Git-Tag: v2.6.28-rc1~605^2~5
X-Git-Url: http://pilppa.com/gitweb/?a=commitdiff_plain;h=ab396eb03f33a2e2afb7b0603a43929bf5857c45;p=linux-2.6-omap-h63xx.git

net: Fix off-by-one in skb_dma_map

The unwind loop iterates down to -1 instead of stopping at 0 and ends up
accessing ->frags[-1].

Signed-off-by: Dimitris Michailidis <dm@chelsio.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
---

diff --git a/net/core/skb_dma_map.c b/net/core/skb_dma_map.c
index 1f49afcd8e8..86234923a3b 100644
--- a/net/core/skb_dma_map.c
+++ b/net/core/skb_dma_map.c
@@ -35,7 +35,7 @@ int skb_dma_map(struct device *dev, struct sk_buff *skb,
 	return 0;
 
 unwind:
-	while (i-- >= 0) {
+	while (--i >= 0) {
 		skb_frag_t *fp = &sp->frags[i];
 
 		dma_unmap_page(dev, sp->dma_maps[i + 1],