From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Fri, 6 Nov 2015 10:01:20 +0000 (+0300)
Subject: ath9k_htc: check for underflow in ath9k_htc_rx_msg()
X-Git-Tag: v3.16.35~544
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=639cf97fae1280e2bb1eee1b91a4c641ad1409ef;p=thirdparty%2Fkernel%2Fstable.git

ath9k_htc: check for underflow in ath9k_htc_rx_msg()

commit 3a318426e09a9c9266fe6440842e11238f640a20 upstream.

We check for overflow here, but we don't check for underflow so it
causes a static checker warning.

Fixes: fb9987d0f748 ('ath9k_htc: Support for AR9271 chipset.')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---

diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c
index a0ff5b6370543..93a86e24ff30b 100644
--- a/drivers/net/wireless/ath/ath9k/htc_hst.c
+++ b/drivers/net/wireless/ath/ath9k/htc_hst.c
@@ -415,7 +415,7 @@ void ath9k_htc_rx_msg(struct htc_target *htc_handle,
 		return;
 	}
 
-	if (epid >= ENDPOINT_MAX) {
+	if (epid < 0 || epid >= ENDPOINT_MAX) {
 		if (pipe_id != USB_REG_IN_PIPE)
 			dev_kfree_skb_any(skb);
 		else