diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2011-10-05 08:48:20 +0300 |
|---|---|---|
| committer | John W. Linville <linville@tuxdriver.com> | 2011-10-11 16:41:10 -0400 |
| commit | f49bbd2a45bf37d9fe202486712c89c214e33b5a (patch) | |
| tree | 87ba96e3365c600cb85f76cbc5935c33bdfa1b82 /drivers/net/wireless/ath | |
| parent | 8fb7475bde74814e5f9d0871590e00a6acb36a20 (diff) | |
ath9k: remove some bogus error handling code
If "axq_qnum >= ARRAY_SIZE(sc->tx.txq)", then the call to
ath9k_hw_releasetxqueue() would read beyond the end of the ah->txq[]
array and possibly corrupt memory. Fortunately,
ath9k_hw_setuptxqueue() doesn't return high values of "axq_qnum" and
this code can be removed.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'drivers/net/wireless/ath')
| -rw-r--r-- | drivers/net/wireless/ath/ath9k/xmit.c | 7 |
1 files changed, 0 insertions, 7 deletions
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c index c2bfc57958d8..b4a07718b300 100644 --- a/drivers/net/wireless/ath/ath9k/xmit.c +++ b/drivers/net/wireless/ath/ath9k/xmit.c @@ -1255,7 +1255,6 @@ static void ath_txq_drain_pending_buffers(struct ath_softc *sc, struct ath_txq *ath_txq_setup(struct ath_softc *sc, int qtype, int subtype) { struct ath_hw *ah = sc->sc_ah; - struct ath_common *common = ath9k_hw_common(ah); struct ath9k_tx_queue_info qi; static const int subtype_txq_to_hwq[] = { [WME_AC_BE] = ATH_TXQ_AC_BE, @@ -1305,12 +1304,6 @@ struct ath_txq *ath_txq_setup(struct ath_softc *sc, int qtype, int subtype) */ return NULL; } - if (axq_qnum >= ARRAY_SIZE(sc->tx.txq)) { - ath_err(common, "qnum %u out of range, max %zu!\n", - axq_qnum, ARRAY_SIZE(sc->tx.txq)); - ath9k_hw_releasetxqueue(ah, axq_qnum); - return NULL; - } if (!ATH_TXQ_SETUP(sc, axq_qnum)) { struct ath_txq *txq = &sc->tx.txq[axq_qnum]; |