ath9k_htc: check for underflow in ath9k_htc_rx_msg()

[pandora-kernel.git] / drivers / net / wireless / ath / ath9k / htc_hst.c

diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c
index 1b90ed8..51e256e 100644 (file)
--- a/drivers/net/wireless/ath/ath9k/htc_hst.c
+++ b/drivers/net/wireless/ath/ath9k/htc_hst.c
@@ -342,6 +342,8 @@ void ath9k_htc_txcompletion_cb(struct htc_target *htc_handle,
                        endpoint->ep_callbacks.tx(endpoint->ep_callbacks.priv,
                                                  skb, htc_hdr->endpoint_id,
                                                  txok);
+               } else {
+                       kfree_skb(skb);
                }
        }
 
@@ -375,7 +377,7 @@ void ath9k_htc_rx_msg(struct htc_target *htc_handle,
        htc_hdr = (struct htc_frame_hdr *) skb->data;
        epid = htc_hdr->endpoint_id;
 
-       if (epid >= ENDPOINT_MAX) {
+       if (epid < 0 || epid >= ENDPOINT_MAX) {
                if (pipe_id != USB_REG_IN_PIPE)
                        dev_kfree_skb_any(skb);
                else