From 718126a75e5fd4c6df6ee0567f00c7345b2370f4 Mon Sep 17 00:00:00 2001 From: Christian Lamparter Date: Fri, 7 Aug 2009 19:38:51 +0200 Subject: [PATCH] p54: Write outside array bounds This patch fixes a coding error which allowed the to upper-layer to corrupt limited portions of the phy data. Signed-off-by: Christian Lamparter Signed-off-by: John W. Linville --- drivers/net/wireless/p54/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/p54/main.c b/drivers/net/wireless/p54/main.c index a0d0e72..b99ee9b 100644 --- a/drivers/net/wireless/p54/main.c +++ b/drivers/net/wireless/p54/main.c @@ -317,7 +317,7 @@ static int p54_conf_tx(struct ieee80211_hw *dev, u16 queue, int ret; mutex_lock(&priv->conf_mutex); - if ((params) && !(queue > 4)) { + if (queue < dev->queues) { P54_SET_QUEUE(priv->qos_params[queue], params->aifs, params->cw_min, params->cw_max, params->txop); ret = p54_set_edcf(priv); -- 2.7.4