archive mirror
 help / color / mirror / Atom feed
* [PATCH 1/2] p54: Write outside array bounds
@ 2009-08-07 17:38 Christian Lamparter
  0 siblings, 0 replies; only message in thread
From: Christian Lamparter @ 2009-08-07 17:38 UTC (permalink / raw)
  To: wireless; +Cc: John W. Linville, Dan Carpenter

This patch fixes a coding error which allowed the to upper-layer to
corrupt limited portions of the phy data.

Signed-off-by: Christian Lamparter <>

mac80211 guarantees that params is a valid pointer, so
the _other_ check is no longer needed.
diff --git a/drivers/net/wireless/p54/main.c b/drivers/net/wireless/p54/main.c
index a0d0e72..bcab4c6 100644
--- a/drivers/net/wireless/p54/main.c
+++ b/drivers/net/wireless/p54/main.c
@@ -317,7 +317,7 @@ static int p54_conf_tx(struct ieee80211_hw *dev, u16 queue,
 	int ret;
-	if ((params) && !(queue > 4)) {
+	if (queue < dev->queues) {
 		P54_SET_QUEUE(priv->qos_params[queue], params->aifs,
 			params->cw_min, params->cw_max, params->txop);
 		ret = p54_set_edcf(priv);

^ permalink raw reply related	[flat|nested] only message in thread

only message in thread, other threads:[~2009-08-07 17:38 UTC | newest]

Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2009-08-07 17:38 [PATCH 1/2] p54: Write outside array bounds Christian Lamparter

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).