From: Christian Lamparter <chunkeey@web.de>
Date: Fri, 7 Aug 2009 17:38:51 +0000 (+0200)
Subject: p54: Write outside array bounds
X-Git-Url: http://git.mmlx.us/?a=commitdiff_plain;h=718126a75e5fd4c6df6ee0567f00c7345b2370f4;p=linux-edison.git

p54: Write outside array bounds

This patch fixes a coding error which allowed the to upper-layer to
corrupt limited portions of the phy data.

Signed-off-by: Christian Lamparter <chunkeey@web.de>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
---

diff --git a/drivers/net/wireless/p54/main.c b/drivers/net/wireless/p54/main.c
index a0d0e726bc4..b99ee9b472b 100644
--- a/drivers/net/wireless/p54/main.c
+++ b/drivers/net/wireless/p54/main.c
@@ -317,7 +317,7 @@ static int p54_conf_tx(struct ieee80211_hw *dev, u16 queue,
 	int ret;
 
 	mutex_lock(&priv->conf_mutex);
-	if ((params) && !(queue > 4)) {
+	if (queue < dev->queues) {
 		P54_SET_QUEUE(priv->qos_params[queue], params->aifs,
 			params->cw_min, params->cw_max, params->txop);
 		ret = p54_set_edcf(priv);