lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

ath9k: remove some bogus error handling code

Browse Source 
If "axq_qnum >= ARRAY_SIZE(sc->tx.txq)", then the call to
ath9k_hw_releasetxqueue() would read beyond the end of the ah->txq[]
array and possibly corrupt memory.  Fortunately,
ath9k_hw_setuptxqueue() doesn't return high values of "axq_qnum" and
this code can be removed.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
This commit is contained in:
Dan Carpenter
2011-10-05 08:48:20 +03:00
committed by John W. Linville
parent 8fb7475bde
commit f49bbd2a45
1 changed files with 0 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
drivers/net/wireless/ath/ath9k/xmit.c
View File

@@ -1255,7 +1255,6 @@ static void ath_txq_drain_pending_buffers(struct ath_softc *sc,
struct ath_txq *ath_txq_setup(struct ath_softc *sc, int qtype, int subtype) struct ath_txq *ath_txq_setup(struct ath_softc *sc, int qtype, int subtype)
{ {
struct ath_hw *ah = sc->sc_ah; struct ath_hw *ah = sc->sc_ah;
struct ath_common *common = ath9k_hw_common(ah);
struct ath9k_tx_queue_info qi; struct ath9k_tx_queue_info qi;
static const int subtype_txq_to_hwq[] = { static const int subtype_txq_to_hwq[] = {
[WME_AC_BE] = ATH_TXQ_AC_BE, [WME_AC_BE] = ATH_TXQ_AC_BE,
@@ -1305,12 +1304,6 @@ struct ath_txq *ath_txq_setup(struct ath_softc *sc, int qtype, int subtype)
*/ */
return NULL; return NULL;
} }
if (axq_qnum >= ARRAY_SIZE(sc->tx.txq)) {
ath_err(common, "qnum %u out of range, max %zu!\n",
axq_qnum, ARRAY_SIZE(sc->tx.txq));
ath9k_hw_releasetxqueue(ah, axq_qnum);
return NULL;
}
if (!ATH_TXQ_SETUP(sc, axq_qnum)) { if (!ATH_TXQ_SETUP(sc, axq_qnum)) {
struct ath_txq *txq = &sc->tx.txq[axq_qnum]; struct ath_txq *txq = &sc->tx.txq[axq_qnum];