[PATCH v2] wifi: ath6kl: keep the IBSS node count within the node map

[Pengpeng Hou <pengpeng@iscas.ac.cn>]

node_map has MAX_NODE_NUM entries. When a new peer arrives after the
map is full, ath6kl_ibss_map_epid() increments node_num before rejecting
the mapping. A later lookup then walks one element beyond node_map.

Reject a new mapping before advancing node_num.

Fixes: bdcd81707973 ("Add ath6kl cleaned up driver")
Assisted-by: Codex:gpt-5
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
Changes since v1: https://lore.kernel.org/all/20260722040721.74876-1-pengpeng@iscas.ac.cn/
- rebase on current ath6kl sources
- reject a full map before incrementing node_num

The IBSS map state transitions were reviewed statically; no ath6kl hardware
test was performed.

 drivers/net/wireless/ath/ath6kl/txrx.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/net/wireless/ath/ath6kl/txrx.c b/drivers/net/wireless/ath/ath6kl/txrx.c
index d81825413906..b340c795b7a3 100644
--- a/drivers/net/wireless/ath/ath6kl/txrx.c
+++ b/drivers/net/wireless/ath/ath6kl/txrx.c
@@ -67,10 +67,9 @@ static u8 ath6kl_ibss_map_epid(struct sk_buff *skb, struct net_device *dev,
 	}
 
 	if (ep_map == -1) {
-		ep_map = ar->node_num;
-		ar->node_num++;
-		if (ar->node_num > MAX_NODE_NUM)
+		if (ar->node_num >= MAX_NODE_NUM)
 			return ENDPOINT_UNUSED;
+		ep_map = ar->node_num++;
 	}
 
 	memcpy(ar->node_map[ep_map].mac_addr, eth_hdr->h_dest, ETH_ALEN);
-- 
2.50.1 (Apple Git-155)