From patchwork Sat May 8 16:22:01 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dan Carpenter X-Patchwork-Id: 97918 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by demeter.kernel.org (8.14.3/8.14.3) with ESMTP id o48GMStD010611 for ; Sat, 8 May 2010 16:22:28 GMT Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753733Ab0EHQW1 (ORCPT ); Sat, 8 May 2010 12:22:27 -0400 Received: from mail-qy0-f183.google.com ([209.85.221.183]:57211 "EHLO mail-qy0-f183.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753590Ab0EHQW1 (ORCPT ); Sat, 8 May 2010 12:22:27 -0400 Received: by qyk13 with SMTP id 13so3445524qyk.1 for ; Sat, 08 May 2010 09:22:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:date:from:to:cc:subject :message-id:mime-version:content-type:content-disposition:user-agent; bh=P9ms/AnT51nRofsN/x+wv0BX9lfP5x+OGlblHsBgWks=; b=Pst0oPHICT7dPZfW0ZVqCgeH3KsDGzvMQsEO1xMrX1wPCkQooWzytGbozJ7ofek0fi g30LA+Tq0uRiBilfWOfJ4Gnr6w52cXh9+spKkNBJcWwVHBl555lvy/KIrjt3DXmkV9kl PeBBCOuFjba2Wes7/8EKGtUksCIxGoUfk3XFU= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=date:from:to:cc:subject:message-id:mime-version:content-type :content-disposition:user-agent; b=nUZ5LlJepJwOWbuAL7URXh/Vg0pONqXfpGG6u/7832B/7CQfO590N6+pVeP6K3Nf80 E/DXQQG6sah0czNKzJDdFi3pb21aOTF7XjyuLi0iv4TxOlRBioXABnw1orvpltLnT555 VOXuaetyoKkwshRAVC15tYKFqhbh/9fcR8YUA= Received: by 10.224.36.15 with SMTP id r15mr1029063qad.129.1273335746400; Sat, 08 May 2010 09:22:26 -0700 (PDT) Received: from bicker ([205.177.176.130]) by mx.google.com with ESMTPS id a11sm2071306qco.4.2010.05.08.09.22.19 (version=TLSv1/SSLv3 cipher=RC4-MD5); Sat, 08 May 2010 09:22:25 -0700 (PDT) Date: Sat, 8 May 2010 18:22:01 +0200 From: Dan Carpenter To: "Luis R. Rodriguez" Cc: Jouni Malinen , Sujith Manoharan , Vasanthakumar Thiagarajan , Senthil Balasubramanian , "John W. Linville" , Ming Lei , linux-wireless@vger.kernel.org, ath9k-devel@venema.h4ckr.net Subject: [patch 2/9] ath9k: range checking issues in htc_hst.c Message-ID: <20100508162201.GN27064@bicker> MIME-Version: 1.0 Content-Disposition: inline User-Agent: Mutt/1.5.18 (2008-05-17) Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.2.3 (demeter.kernel.org [140.211.167.41]); Sat, 08 May 2010 16:22:29 +0000 (UTC) diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c index 7bf6ce1..0c062d0 100644 --- a/drivers/net/wireless/ath/ath9k/htc_hst.c +++ b/drivers/net/wireless/ath/ath9k/htc_hst.c @@ -116,7 +116,7 @@ static void htc_process_conn_rsp(struct htc_target *target, max_msglen = be16_to_cpu(svc_rspmsg->max_msg_len); endpoint = &target->endpoint[epid]; - for (tepid = ENDPOINT_MAX; tepid > ENDPOINT0; tepid--) { + for (tepid = HST_ENDPOINT_MAX - 1; tepid >= ENDPOINT0; tepid--) { tmp_endpoint = &target->endpoint[tepid]; if (tmp_endpoint->service_id == service_id) { tmp_endpoint->service_id = 0; @@ -124,7 +124,7 @@ static void htc_process_conn_rsp(struct htc_target *target, } } - if (!tmp_endpoint) + if (tepid < ENDPOINT0) return; endpoint->service_id = service_id; @@ -297,7 +297,7 @@ void htc_stop(struct htc_target *target) enum htc_endpoint_id epid; struct htc_endpoint *endpoint; - for (epid = ENDPOINT0; epid <= ENDPOINT_MAX; epid++) { + for (epid = ENDPOINT0; epid < HST_ENDPOINT_MAX; epid++) { endpoint = &target->endpoint[epid]; if (endpoint->service_id != 0) target->hif->stop(target->hif_dev, endpoint->ul_pipeid); @@ -309,7 +309,7 @@ void htc_start(struct htc_target *target) enum htc_endpoint_id epid; struct htc_endpoint *endpoint; - for (epid = ENDPOINT0; epid <= ENDPOINT_MAX; epid++) { + for (epid = ENDPOINT0; epid < HST_ENDPOINT_MAX; epid++) { endpoint = &target->endpoint[epid]; if (endpoint->service_id != 0) target->hif->start(target->hif_dev, @@ -377,7 +377,7 @@ void ath9k_htc_rx_msg(struct htc_target *htc_handle, htc_hdr = (struct htc_frame_hdr *) skb->data; epid = htc_hdr->endpoint_id; - if (epid >= ENDPOINT_MAX) { + if (epid >= HST_ENDPOINT_MAX) { if (pipe_id != USB_REG_IN_PIPE) dev_kfree_skb_any(skb); else