kernel/net/sched/sch_htb.c
.. .. @@ -405,7 +405,10 @@ 405 405 while (cl->cmode == HTB_MAY_BORROW && p && mask) { 406 406 m = mask; 407 407 while (m) { 408 - int prio = ffz(~m);408 + unsigned int prio = ffz(~m);409 +410 + if (WARN_ON_ONCE(prio >= ARRAY_SIZE(p->inner.clprio)))411 + break;409 412 m &= ~(1 << prio); 410 413 411 414 if (p->inner.clprio[prio].feed.rb_node)