diff options
author | roel kluin <roel.kluin@gmail.com> | 2009-07-25 08:38:33 -0400 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2009-07-26 21:50:39 -0400 |
commit | c65d3198addb1a2862d4b88bc2a74ac9cbed66f9 (patch) | |
tree | 03d4d23ff834aea7ba637860aea0a604924a2bc6 /drivers/net/tokenring | |
parent | 3b73e79b0dcc86f8bec68a34b7fb812eec953f34 (diff) |
tokenring: Read buffer overflow
io[i] is read before the bounds check on i, order should be reversed
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net/tokenring')
-rw-r--r-- | drivers/net/tokenring/ibmtr.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/tokenring/ibmtr.c b/drivers/net/tokenring/ibmtr.c index 9d896116cf76..08a6c41c1599 100644 --- a/drivers/net/tokenring/ibmtr.c +++ b/drivers/net/tokenring/ibmtr.c | |||
@@ -1912,7 +1912,7 @@ static int __init ibmtr_init(void) | |||
1912 | 1912 | ||
1913 | find_turbo_adapters(io); | 1913 | find_turbo_adapters(io); |
1914 | 1914 | ||
1915 | for (i = 0; io[i] && (i < IBMTR_MAX_ADAPTERS); i++) { | 1915 | for (i = 0; i < IBMTR_MAX_ADAPTERS && io[i]; i++) { |
1916 | struct net_device *dev; | 1916 | struct net_device *dev; |
1917 | irq[i] = 0; | 1917 | irq[i] = 0; |
1918 | mem[i] = 0; | 1918 | mem[i] = 0; |