[PATCH v3 2/5] wifi: ath9k: name the register multi-read limit
From: Nerijus Bendžiūnas <hidden>
Date: 2026-09-04 18:53:14
Also in:
lkml
Subsystem:
atheros ath generic utilities, qualcomm atheros ath9k wireless driver, the rest · Maintainers:
Jeff Johnson, Toke Høiland-Jørgensen, Linus Torvalds
ath9k_multi_regread() converts the addresses and the results through fixed 8-entry arrays and does not check the count it is given, so every REG_READ_MULTI() caller has to stay at 8 or below, which nothing states. Two callers ask for exactly 8: ar9271_hw_pa_cal() through REG_READ_ARRAY() and ath9k_hw_usb_gen_fill_eeprom(). Define ATH9K_MULTI_READ_MAX next to REG_READ_MULTI() and size the arrays with it. A larger count warns once and is reported as a failed read, all ones, instead of writing past the arrays. Assisted-by: Claude:claude-fable-5-1 Signed-off-by: Nerijus Bendžiūnas <redacted> --- drivers/net/wireless/ath/ath9k/htc_drv_init.c | 9 +++++++-- drivers/net/wireless/ath/ath9k/hw.h | 7 +++++++ 2 files changed, 14 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
index f5844e9bdd2d..3d4c6f9f6e95 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c@@ -258,10 +258,15 @@ static void ath9k_multi_regread(void *hw_priv, u32 *addr, struct ath_hw *ah = hw_priv; struct ath_common *common = ath9k_hw_common(ah); struct ath9k_htc_priv *priv = common->priv; - __be32 tmpaddr[8]; - __be32 tmpval[8]; + __be32 tmpaddr[ATH9K_MULTI_READ_MAX]; + __be32 tmpval[ATH9K_MULTI_READ_MAX]; int i, ret; + if (WARN_ON_ONCE(count > ATH9K_MULTI_READ_MAX)) { + memset(val, 0xff, sizeof(*val) * count); + return; + } + for (i = 0; i < count; i++) { tmpaddr[i] = cpu_to_be32(addr[i]); }
diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
index b942b8303d8f..211d42c92796 100644
--- a/drivers/net/wireless/ath/ath9k/hw.h
+++ b/drivers/net/wireless/ath/ath9k/hw.h@@ -83,6 +83,13 @@ #define REG_READ(_ah, _reg) \ (_ah)->reg_ops.read((_ah), (_reg)) +/* + * Maximum number of registers one REG_READ_MULTI() may ask for. The ath9k_htc + * implementation converts the addresses and the results through fixed arrays + * of this size; callers must split larger reads themselves. + */ +#define ATH9K_MULTI_READ_MAX 8 + #define REG_READ_MULTI(_ah, _addr, _val, _cnt) \ (_ah)->reg_ops.multi_read((_ah), (_addr), (_val), (_cnt))
--
2.55.0