The bug here is that we use "Reject" as the index into the cau_t array
in the else path. Since the cau_t has 9 elements if Reject == 9 then
we are reading beyond the end of the array.
My understanding of the code is that it's saying that if Reject is 1 or
too high then that's invalid and we should hang up.
Signed-off-by: Dan Carpenter <email@example.com>
Signed-off-by: David S. Miller <firstname.lastname@example.org>