diff options
| author |   Pandiyarajan Pitchaimuthu <c_ppitch@qca.qualcomm.com> | 2012-09-21 20:13:09 +0530 |
|---|---|---|
| committer |   Kalle Valo <kvalo@qca.qualcomm.com> | 2012-10-24 11:49:55 +0300 |
| commit | 307749406d7daea452d55df76f734b4fffddf599 (patch) | |
| tree | 00902a49ed37069ef521945f74be362bd7cd2251 /drivers | |
| parent | ath6kl: Array index out of bounds check (diff) | |
ath6kl: Check for valid endpoint ID in ath6kl_tx_complete()
Endpoint ID is checked to make sure it is valid.
Signed-off-by: Pandiyarajan Pitchaimuthu <c_ppitch@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/net/wireless/ath/ath6kl/txrx.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/net/wireless/ath/ath6kl/txrx.c b/drivers/net/wireless/ath/ath6kl/txrx.c index c4501a9f051c..78b369286579 100644 --- a/drivers/net/wireless/ath/ath6kl/txrx.c +++ b/drivers/net/wireless/ath/ath6kl/txrx.c @@ -704,6 +704,10 @@ void ath6kl_tx_complete(struct htc_target *target, list); list_del(&packet->list); + if (WARN_ON_ONCE(packet->endpoint == ENDPOINT_UNUSED || + packet->endpoint >= ENDPOINT_MAX)) + continue; + ath6kl_cookie = (struct ath6kl_cookie *)packet->pkt_cntxt; if (WARN_ON_ONCE(!ath6kl_cookie)) continue; |