irda: precedence bug in irlmp_seq_hb_idx()
authorDan Carpenter <dan.carpenter@oracle.com>
Mon, 19 Oct 2015 10:16:49 +0000 (13:16 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 9 Dec 2015 18:42:51 +0000 (13:42 -0500)
commit200057f03999e051239dac989200430119c6fb76
tree3a01f5662ff14308c923c1c8e186612e96d81f17
parent769b79eb206ad5b0249a08665fefb913c3d1998e
irda: precedence bug in irlmp_seq_hb_idx()

[ Upstream commit 50010c20597d14667eff0fdb628309986f195230 ]

This is decrementing the pointer, instead of the value stored in the
pointer.  KASan detects it as an out of bounds reference.

Reported-by: "Berry Cheng 程君(成淼)" <chengmiao.cj@alibaba-inc.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/irda/irlmp.c