p54: Write outside array bounds
This patch fixes a coding error which allowed the to upper-layer to
corrupt limited portions of the phy data.
Signed-off-by: Christian Lamparter <chunkeey@web.de>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
diff --git a/drivers/net/wireless/p54/main.c b/drivers/net/wireless/p54/main.c
index a0d0e72..b99ee9b 100644
--- a/drivers/net/wireless/p54/main.c
+++ b/drivers/net/wireless/p54/main.c
@@ -317,7 +317,7 @@
int ret;
mutex_lock(&priv->conf_mutex);
- if ((params) && !(queue > 4)) {
+ if (queue < dev->queues) {
P54_SET_QUEUE(priv->qos_params[queue], params->aifs,
params->cw_min, params->cw_max, params->txop);
ret = p54_set_edcf(priv);