diff --git a/[refs] b/[refs]
index ceb1b0dd6202..66274c9094d9 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: d54601b92fbde2a7021a844e1373ba8c778cc0a3
+refs/heads/master: 363f149ce37bea91069177eab691111b242bfe73
diff --git a/trunk/drivers/net/wireless/ath/ath6kl/txrx.c b/trunk/drivers/net/wireless/ath/ath6kl/txrx.c
index efee590a234a..cf4380d573c4 100644
--- a/trunk/drivers/net/wireless/ath/ath6kl/txrx.c
+++ b/trunk/drivers/net/wireless/ath/ath6kl/txrx.c
@@ -293,6 +293,12 @@ int ath6kl_control_tx(void *devt, struct sk_buff *skb,
 		return -EACCES;
 	}
 
+	if (WARN_ON_ONCE(eid == ENDPOINT_UNUSED ||
+			 eid >= ENDPOINT_MAX)) {
+		status = -EINVAL;
+		goto fail_ctrl_tx;
+	}
+
 	spin_lock_bh(&ar->lock);
 
 	ath6kl_dbg(ATH6KL_DBG_WLAN_TX,