irda: precedence bug in irlmp_seq_hb_idx()
[ Upstream commit 50010c20597d14667eff0fdb628309986f195230 ] This is decrementing the pointer, instead of the value stored in the pointer. KASan detects it as an out of bounds reference. Reported-by: "Berry Cheng 程君(成淼)" <chengmiao.cj@alibaba-inc.com> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
bdf8cfb859
commit
edbdd72399
|
@ -1876,7 +1876,7 @@ static void *irlmp_seq_hb_idx(struct irlmp_iter_state *iter, loff_t *off)
|
|||
for (element = hashbin_get_first(iter->hashbin);
|
||||
element != NULL;
|
||||
element = hashbin_get_next(iter->hashbin)) {
|
||||
if (!off || *off-- == 0) {
|
||||
if (!off || (*off)-- == 0) {
|
||||
/* NB: hashbin left locked */
|
||||
return element;
|
||||
}
|
||||
|
|
Loading…
Reference in New Issue