diff options
| author | Christian Lamparter <chunkeey@web.de> | 2009-08-07 19:38:51 +0200 |
|---|---|---|
| committer | John W. Linville <linville@tuxdriver.com> | 2009-08-14 09:13:45 -0400 |
| commit | 718126a75e5fd4c6df6ee0567f00c7345b2370f4 (patch) | |
| tree | 1e6ab17e8d2ef9754218d3e5e5c8bf0f27a90054 | |
| parent | 66d2d089c394c7e31020947d682523f77a93244b (diff) | |
p54: Write outside array bounds
This patch fixes a coding error which allowed the to upper-layer to
corrupt limited portions of the phy data.
Signed-off-by: Christian Lamparter <chunkeey@web.de>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
| -rw-r--r-- | drivers/net/wireless/p54/main.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/wireless/p54/main.c b/drivers/net/wireless/p54/main.c index a0d0e726bc4e..b99ee9b472b6 100644 --- a/drivers/net/wireless/p54/main.c +++ b/drivers/net/wireless/p54/main.c @@ -317,7 +317,7 @@ static int p54_conf_tx(struct ieee80211_hw *dev, u16 queue, int ret; mutex_lock(&priv->conf_mutex); - if ((params) && !(queue > 4)) { + if (queue < dev->queues) { P54_SET_QUEUE(priv->qos_params[queue], params->aifs, params->cw_min, params->cw_max, params->txop); ret = p54_set_edcf(priv); |