[patch 63/71] ar9170: fix read & write outside array bounds

[Greg KH]

2.6.30-stable review patch.  If anyone has any objections, please let us know.

------------------
From: Dan Carpenter <error27@xxxxxxxxx>

commit e9d126cdfa60b575f1b5b02024c4faee27dccf07 upstream.

Backport done by Christian Lamparter <chunkeey@xxxxxxxxxxxxxx>

queue == __AR9170_NUM_TXQ would cause a bug on the next line.

found by Smatch ( http://repo.or.cz/w/smatch.git ).

Reported-by: Dan Carpenter <error27@xxxxxxxxx>
Signed-off-by: Dan Carpenter <error27@xxxxxxxxx>
Signed-off-by: Christian Lamparter <chunkeey@xxxxxx>
Signed-off-by: John W. Linville <linville@xxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxx>

---
 drivers/net/wireless/ar9170/main.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

--- a/drivers/net/wireless/ar9170/main.c
+++ b/drivers/net/wireless/ar9170/main.c
@@ -1486,13 +1486,14 @@ static int ar9170_conf_tx(struct ieee802
 	int ret;
 
 	mutex_lock(&ar->mutex);
-	if ((param) && !(queue > ar->hw->queues)) {
+	if (queue < __AR9170_NUM_TXQ) {
 		memcpy(&ar->edcf[ar9170_qos_hwmap[queue]],
 		       param, sizeof(*param));
 
 		ret = ar9170_set_qos(ar);
-	} else
+	} else {
 		ret = -EINVAL;
+	}
 
 	mutex_unlock(&ar->mutex);
 	return ret;


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/