This is a note to let you know that I've just added the patch titled ath9k_htc: check for underflow in ath9k_htc_rx_msg() to the 4.4-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: ath9k_htc-check-for-underflow-in-ath9k_htc_rx_msg.patch and it can be found in the queue-4.4 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 3a318426e09a9c9266fe6440842e11238f640a20 Mon Sep 17 00:00:00 2001 From: Dan Carpenter <dan.carpenter@xxxxxxxxxx> Date: Fri, 6 Nov 2015 13:01:20 +0300 Subject: ath9k_htc: check for underflow in ath9k_htc_rx_msg() From: Dan Carpenter <dan.carpenter@xxxxxxxxxx> commit 3a318426e09a9c9266fe6440842e11238f640a20 upstream. We check for overflow here, but we don't check for underflow so it causes a static checker warning. Fixes: fb9987d0f748 ('ath9k_htc: Support for AR9271 chipset.') Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx> Signed-off-by: Kalle Valo <kvalo@xxxxxxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- drivers/net/wireless/ath/ath9k/htc_hst.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/net/wireless/ath/ath9k/htc_hst.c +++ b/drivers/net/wireless/ath/ath9k/htc_hst.c @@ -414,7 +414,7 @@ void ath9k_htc_rx_msg(struct htc_target return; } - if (epid >= ENDPOINT_MAX) { + if (epid < 0 || epid >= ENDPOINT_MAX) { if (pipe_id != USB_REG_IN_PIPE) dev_kfree_skb_any(skb); else Patches currently in stable-queue which might be from dan.carpenter@xxxxxxxxxx are queue-4.4/net-moxa-fix-an-error-code.patch queue-4.4/cx23885-uninitialized-variable-in-cx23885_av_work_handler.patch queue-4.4/power-ipaq-micro-battery-freeing-the-wrong-variable.patch queue-4.4/i40e-fix-an-uninitialized-variable-bug.patch queue-4.4/mips-rm7000-double-locking-bug-in-rm7k_tc_disable.patch queue-4.4/btrfs-clean-up-an-error-code-in-btrfs_init_space_info.patch queue-4.4/xprtrdma-checking-for-null-instead-of-is_err.patch queue-4.4/asoc-intel-pass-correct-parameter-in-sst_alloc_stream_mrfld.patch queue-4.4/ath9k_htc-check-for-underflow-in-ath9k_htc_rx_msg.patch queue-4.4/qlcnic-use-the-correct-ring-in-qlcnic_83xx_process_rcv_ring_diag.patch queue-4.4/mips-octeon-off-by-one-in-octeon_irq_gpio_map.patch queue-4.4/qede-uninitialized-variable-in-qede_start_xmit.patch queue-4.4/mfd-lp8788-irq-uninitialized-variable-in-irq-handler.patch queue-4.4/nfc-nci-memory-leak-in-nci_core_conn_create.patch queue-4.4/ethernet-micrel-fix-some-error-codes.patch queue-4.4/am437x-vpfe-fix-an-uninitialized-variable-bug.patch queue-4.4/qlcnic-potential-null-dereference-in-qlcnic_83xx_get_minidump_template.patch queue-4.4/bpf-mips-fix-off-by-one-in-ctx-offset-allocation.patch queue-4.4/mdio-sun4i-oops-in-error-handling-in-probe.patch queue-4.4/vfio-platform-reset-fix-a-warning-message-condition.patch queue-4.4/x86-apic-uv-silence-a-shift-wrapping-warning.patch