Commit 50010c20 authored by Dan Carpenter's avatar Dan Carpenter Committed by David S. Miller

irda: precedence bug in irlmp_seq_hb_idx()

This is decrementing the pointer, instead of the value stored in the
pointer.  KASan detects it as an out of bounds reference.
Reported-by: default avatar"Berry Cheng 程君(成淼)" <chengmiao.cj@alibaba-inc.com>
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent ca88ea12
...@@ -1839,7 +1839,7 @@ static void *irlmp_seq_hb_idx(struct irlmp_iter_state *iter, loff_t *off) ...@@ -1839,7 +1839,7 @@ static void *irlmp_seq_hb_idx(struct irlmp_iter_state *iter, loff_t *off)
for (element = hashbin_get_first(iter->hashbin); for (element = hashbin_get_first(iter->hashbin);
element != NULL; element != NULL;
element = hashbin_get_next(iter->hashbin)) { element = hashbin_get_next(iter->hashbin)) {
if (!off || *off-- == 0) { if (!off || (*off)-- == 0) {
/* NB: hashbin left locked */ /* NB: hashbin left locked */
return element; return element;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment