pktgen: do not access flows[] beyond its length
authorFlorian Westphal <fw@strlen.de>
Thu, 21 May 2009 22:07:12 +0000 (15:07 -0700)
committerDavid S. Miller <davem@davemloft.net>
Thu, 21 May 2009 22:07:12 +0000 (15:07 -0700)
typo -- pkt_dev->nflows is for stats only, the number of concurrent
flows is stored in cflows.

Reported-By: Vladimir Ivashchenko <hazard@francoudi.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/core/pktgen.c

index 3779c1438c11c84613f5ba9b40619907c9a18a9d..0666a827bc62d3a9cd067c744c650f4d6337d563 100644 (file)
@@ -2447,7 +2447,7 @@ static inline void free_SAs(struct pktgen_dev *pkt_dev)
        if (pkt_dev->cflows) {
                /* let go of the SAs if we have them */
                int i = 0;
-               for (;  i < pkt_dev->nflows; i++){
+               for (;  i < pkt_dev->cflows; i++) {
                        struct xfrm_state *x = pkt_dev->flows[i].x;
                        if (x) {
                                xfrm_state_put(x);