From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:46839 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754996AbbKQWjV (ORCPT ); Tue, 17 Nov 2015 17:39:21 -0500 Subject: Patch "irda: precedence bug in irlmp_seq_hb_idx()" has been added to the 4.1-stable tree To: dan.carpenter@oracle.com, chengmiao.cj@alibaba-inc.com, davem@davemloft.net, gregkh@linuxfoundation.org Cc: , From: Date: Tue, 17 Nov 2015 14:39:20 -0800 Message-ID: <144779996023767@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org List-ID: This is a note to let you know that I've just added the patch titled irda: precedence bug in irlmp_seq_hb_idx() to the 4.1-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: irda-precedence-bug-in-irlmp_seq_hb_idx.patch and it can be found in the queue-4.1 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >>From foo@baz Tue Nov 17 14:35:45 PST 2015 From: Dan Carpenter Date: Mon, 19 Oct 2015 13:16:49 +0300 Subject: irda: precedence bug in irlmp_seq_hb_idx() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit From: Dan Carpenter [ Upstream commit 50010c20597d14667eff0fdb628309986f195230 ] This is decrementing the pointer, instead of the value stored in the pointer. KASan detects it as an out of bounds reference. Reported-by: "Berry Cheng 程君(成淼)" Signed-off-by: Dan Carpenter Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/irda/irlmp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/net/irda/irlmp.c +++ b/net/irda/irlmp.c @@ -1839,7 +1839,7 @@ static void *irlmp_seq_hb_idx(struct irl for (element = hashbin_get_first(iter->hashbin); element != NULL; element = hashbin_get_next(iter->hashbin)) { - if (!off || *off-- == 0) { + if (!off || (*off)-- == 0) { /* NB: hashbin left locked */ return element; } Patches currently in stable-queue which might be from dan.carpenter@oracle.com are queue-4.1/irda-precedence-bug-in-irlmp_seq_hb_idx.patch