From c65d3198addb1a2862d4b88bc2a74ac9cbed66f9 Mon Sep 17 00:00:00 2001
From: roel kluin <roel.kluin@gmail.com>
Date: Sat, 25 Jul 2009 12:38:33 +0000
Subject: [PATCH] tokenring: Read buffer overflow
io[i] is read before the bounds check on i, order should be reversed
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
---
drivers/net/tokenring/ibmtr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/tokenring/ibmtr.c b/drivers/net/tokenring/ibmtr.c
index 9d896116cf76..08a6c41c1599 100644
--- a/drivers/net/tokenring/ibmtr.c
+++ b/drivers/net/tokenring/ibmtr.c
@@ -1912,7 +1912,7 @@ static int __init ibmtr_init(void)
find_turbo_adapters(io);
- for (i = 0; io[i] && (i < IBMTR_MAX_ADAPTERS); i++) {
+ for (i = 0; i < IBMTR_MAX_ADAPTERS && io[i]; i++) {
struct net_device *dev;
irq[i] = 0;
mem[i] = 0;
--
GitLab