From 4071e42a3e0112137ad165ef2589002ef3aedb42 Mon Sep 17 00:00:00 2001 From: Richard Fuchs Date: Tue, 18 Nov 2025 07:50:23 -0400 Subject: [PATCH] MT#55283 fix off-by-one bug Change-Id: I578554e956a6630b49362ea9245255c13d6c69b4 --- kernel-module/xt_RTPENGINE.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel-module/xt_RTPENGINE.c b/kernel-module/xt_RTPENGINE.c index 133be8e80..0f046418b 100644 --- a/kernel-module/xt_RTPENGINE.c +++ b/kernel-module/xt_RTPENGINE.c @@ -2059,7 +2059,7 @@ static void *shm_map_resolve(struct rtpengine_table *t, void *p, size_t size) { goto out; // start address is within range - check end address - if ((unsigned long) p + size >= rmm->uaddr + rmm->size) + if ((unsigned long) p + size > rmm->uaddr + rmm->size) goto out; ret = rmm->kaddr + ((unsigned long) p - rmm->uaddr);