[PATCH v2] wifi: ath9k_htc: fix the byte count of a full RMW buffer flush

ath9k_reg_rmw_buffer() flushes the buffer when it is full, but sizes
the WMI command with sizeof(struct register_write), which is 8 bytes.
The buffer holds struct register_rmw entries, which are 12 bytes. For
the 15 entries of a full buffer the firmware receives 120 bytes instead
of 180 and applies only the first 10 read-modify-writes.

ath9k_reg_rmw_flush() already uses the correct size. Use it in the
full-buffer path as well.

No current caller fills the buffer; ath9k_hw_4k_set_gain() comes
closest with 14 entries. The first caller to queue a 15th entry loses
its last five writes without any error, which is why this is worth
having in stable trees before one appears.

Fixes: 8badb50cfab6 ("ath9k_htc: add new WMI_REG_RMW_CMDID command")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-fable-5-1
Signed-off-by: Nerijus Bendžiūnas <redacted>
---
Changes in v2:
- Add Assisted-by, rewrite the commit message, rebase onto ath-next. No
  code change.

 drivers/net/wireless/ath/ath9k/htc_drv_init.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
index 6de78ae85726..0b49d2cc99f0 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c

@@ -405,7 +405,7 @@ static void ath9k_reg_rmw_buffer(void *hw_priv,
 	if (priv->wmi->multi_rmw_idx == MAX_RMW_CMD_NUMBER) {
 		r = ath9k_wmi_cmd(priv->wmi, WMI_REG_RMW_CMDID,
 			  (u8 *) &priv->wmi->multi_rmw,
-			  sizeof(struct register_write) * priv->wmi->multi_rmw_idx,
+			  sizeof(struct register_rmw) * priv->wmi->multi_rmw_idx,
 			  (u8 *) &rsp_status, sizeof(rsp_status),
 			  100);
 		if (unlikely(r)) {

base-commit: 1d8e73163ef933624341075f576e2f36ef9133f7
-- 
2.55.0