aboutsummaryrefslogtreecommitdiff
path: root/drivers/net
diff options
context:
space:
mode:
authorChristian Lamparter <chunkeey@web.de>2009-08-07 19:38:51 +0200
committerJohn W. Linville <linville@tuxdriver.com>2009-08-14 09:13:45 -0400
commit718126a75e5fd4c6df6ee0567f00c7345b2370f4 (patch)
tree1e6ab17e8d2ef9754218d3e5e5c8bf0f27a90054 /drivers/net
parent66d2d089c394c7e31020947d682523f77a93244b (diff)
p54: Write outside array bounds
This patch fixes a coding error which allowed the to upper-layer to corrupt limited portions of the phy data. Signed-off-by: Christian Lamparter <chunkeey@web.de> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'drivers/net')
-rw-r--r--drivers/net/wireless/p54/main.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/wireless/p54/main.c b/drivers/net/wireless/p54/main.c
index a0d0e726bc4..b99ee9b472b 100644
--- a/drivers/net/wireless/p54/main.c
+++ b/drivers/net/wireless/p54/main.c
@@ -317,7 +317,7 @@ static int p54_conf_tx(struct ieee80211_hw *dev, u16 queue,
int ret;
mutex_lock(&priv->conf_mutex);
- if ((params) && !(queue > 4)) {
+ if (queue < dev->queues) {
P54_SET_QUEUE(priv->qos_params[queue], params->aifs,
params->cw_min, params->cw_max, params->txop);
ret = p54_set_edcf(priv);