Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932262AbbKXWgX (ORCPT ); Tue, 24 Nov 2015 17:36:23 -0500 Received: from shadbolt.e.decadent.org.uk ([88.96.1.126]:40320 "EHLO shadbolt.e.decadent.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755455AbbKXWfm (ORCPT ); Tue, 24 Nov 2015 17:35:42 -0500 Content-Type: text/plain; charset="UTF-8" Content-Disposition: inline Content-Transfer-Encoding: 8bit MIME-Version: 1.0 From: Ben Hutchings To: linux-kernel@vger.kernel.org, stable@vger.kernel.org CC: akpm@linux-foundation.org, "=?UTF-8?Q?Berry=C2=A0Cheng=20?= =?UTF-8?Q?=E7=A8=8B=E5=90=9B?=(=?UTF-8?Q?=E6=88=90=E6=B7=BC?=)" , "David S. Miller" , "Dan Carpenter" Date: Tue, 24 Nov 2015 22:33:59 +0000 Message-ID: X-Mailer: LinuxStableQueue (scripts by bwh) Subject: [PATCH 3.2 48/52] irda: precedence bug in irlmp_seq_hb_idx() In-Reply-To: X-SA-Exim-Connect-IP: 192.168.4.247 X-SA-Exim-Mail-From: ben@decadent.org.uk X-SA-Exim-Scanned: No (on shadbolt.decadent.org.uk); SAEximRunCond expanded to false Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1249 Lines: 36 3.2.74-rc1 review patch. If anyone has any objections, please let me know. ------------------ From: Dan Carpenter [ Upstream commit 50010c20597d14667eff0fdb628309986f195230 ] This is decrementing the pointer, instead of the value stored in the pointer. KASan detects it as an out of bounds reference. Reported-by: "Berry Cheng 程君(成淼)" Signed-off-by: Dan Carpenter Signed-off-by: David S. Miller Signed-off-by: Ben Hutchings --- net/irda/irlmp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/net/irda/irlmp.c +++ b/net/irda/irlmp.c @@ -1868,7 +1868,7 @@ static void *irlmp_seq_hb_idx(struct irl for (element = hashbin_get_first(iter->hashbin); element != NULL; element = hashbin_get_next(iter->hashbin)) { - if (!off || *off-- == 0) { + if (!off || (*off)-- == 0) { /* NB: hashbin left locked */ return element; } -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/