| From | Ben Hutchings <> | Date | Tue, 24 Nov 2015 22:33:59 +0000 | Subject | [PATCH 3.2 48/52] irda: precedence bug in irlmp_seq_hb_idx() |
| |
3.2.74-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
[ Upstream commit 50010c20597d14667eff0fdb628309986f195230 ]
This is decrementing the pointer, instead of the value stored in the pointer. KASan detects it as an out of bounds reference.
Reported-by: "Berry Cheng 程君(成淼)" <chengmiao.cj@alibaba-inc.com> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Ben Hutchings <ben@decadent.org.uk> --- net/irda/irlmp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/irda/irlmp.c +++ b/net/irda/irlmp.c @@ -1868,7 +1868,7 @@ static void *irlmp_seq_hb_idx(struct irl for (element = hashbin_get_first(iter->hashbin); element != NULL; element = hashbin_get_next(iter->hashbin)) { - if (!off || *off-- == 0) { + if (!off || (*off)-- == 0) { /* NB: hashbin left locked */ return element; }
|