summaryrefslogtreecommitdiffstats
path: root/src/drivers/net/ath
diff options
context:
space:
mode:
authorChristian Hesse2016-05-07 21:20:37 +0200
committerMichael Brown2016-05-12 15:55:13 +0200
commit858f56e68b7089a3dc8473bb94dd198554a24eeb (patch)
treedaeb28e66579c731e07e3d16380dda19c911e882 /src/drivers/net/ath
parent[arm] Use CNTVCT_EL0 as profiling timestamp (diff)
downloadipxe-858f56e68b7089a3dc8473bb94dd198554a24eeb.tar.gz
ipxe-858f56e68b7089a3dc8473bb94dd198554a24eeb.tar.xz
ipxe-858f56e68b7089a3dc8473bb94dd198554a24eeb.zip
[ath9k] Fix buffer overrun for ar9287
This backport is from linux kernel upstream commit 83d6f1f ("ath9k: fix buffer overrun for ar9287"). Signed-off-by: Christian Hesse <mail@eworm.de> Signed-off-by: Michael Brown <mcb30@ipxe.org>
Diffstat (limited to 'src/drivers/net/ath')
-rw-r--r--src/drivers/net/ath/ath9k/ath9k_eeprom.c7
1 files changed, 3 insertions, 4 deletions
diff --git a/src/drivers/net/ath/ath9k/ath9k_eeprom.c b/src/drivers/net/ath/ath9k/ath9k_eeprom.c
index f552acaa..a2042379 100644
--- a/src/drivers/net/ath/ath9k/ath9k_eeprom.c
+++ b/src/drivers/net/ath/ath9k/ath9k_eeprom.c
@@ -368,10 +368,9 @@ void ath9k_hw_get_gain_boundaries_pdadcs(struct ath_hw *ah,
if (match) {
if (AR_SREV_9287(ah)) {
- /* FIXME: array overrun? */
for (i = 0; i < numXpdGains; i++) {
minPwrT4[i] = data_9287[idxL].pwrPdg[i][0];
- maxPwrT4[i] = data_9287[idxL].pwrPdg[i][4];
+ maxPwrT4[i] = data_9287[idxL].pwrPdg[i][intercepts - 1];
ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i],
data_9287[idxL].pwrPdg[i],
data_9287[idxL].vpdPdg[i],
@@ -381,7 +380,7 @@ void ath9k_hw_get_gain_boundaries_pdadcs(struct ath_hw *ah,
} else if (eeprom_4k) {
for (i = 0; i < numXpdGains; i++) {
minPwrT4[i] = data_4k[idxL].pwrPdg[i][0];
- maxPwrT4[i] = data_4k[idxL].pwrPdg[i][4];
+ maxPwrT4[i] = data_4k[idxL].pwrPdg[i][intercepts - 1];
ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i],
data_4k[idxL].pwrPdg[i],
data_4k[idxL].vpdPdg[i],
@@ -391,7 +390,7 @@ void ath9k_hw_get_gain_boundaries_pdadcs(struct ath_hw *ah,
} else {
for (i = 0; i < numXpdGains; i++) {
minPwrT4[i] = data_def[idxL].pwrPdg[i][0];
- maxPwrT4[i] = data_def[idxL].pwrPdg[i][4];
+ maxPwrT4[i] = data_def[idxL].pwrPdg[i][intercepts - 1];
ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i],
data_def[idxL].pwrPdg[i],
data_def[idxL].vpdPdg[i],