p54: Write outside array bounds

PATCH New Christian Lamparter 1 participant 1 message Aug 7, 2009 Networking drivers (wireless)

lore

Share & tools

lore

Christian Lamparter

author

2009-08-07 17:38 UTC #0 lore raw

PATCH 1/2 p54: Write outside array bounds

This patch fixes a coding error which allowed the to upper-layer to corrupt limited portions of the phy data.

Signed-off-by Christian Lamparter <[email protected]>

---
Note:

mac80211 guarantees that params is a valid pointer, so the _other_ check is no longer needed.
---

drivers/net/wireless/p54/main.c +1 -1

index a0d0e72..bcab4c6 100644
@@ -317,7 +317,7 @@ static int p54_conf_tx(struct ieee80211_hw *dev, u16 queue,
 	int ret;
 
 	mutex_lock(&priv->conf_mutex);
-	if ((params) && !(queue > 4)) {
+	if (queue < dev->queues) {
 		P54_SET_QUEUE(priv->qos_params[queue], params->aifs,
 			params->cw_min, params->cw_max, params->txop);
 		ret = p54_set_edcf(priv);