| commit | f2633d2eaaab773ea8b29cea3785cf0f8a8872a5 | [log] [tgz] |
|---|---|---|
| author | Dan Carpenter <dan.carpenter@oracle.com> | Fri May 27 13:34:35 2016 +0300 |
| committer | David S. Miller <davem@davemloft.net> | Tue May 31 11:52:59 2016 -0700 |
| tree | 7e7a7e03f72c394181ba4feb1ad4752fc78ecef9 | |
| parent | 86f04396ff6d36146ec335d429191a7c8e2209af [diff] |
atm: iphase: off by one in rx_pkt() The iadev->rx_open[] array holds "iadev->num_vc" pointers (this code assumes that pointers are 32 bits). So the > here should be >= or else we could end up reading a garbage pointer from one element beyond the end of the array. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net>