[PATCH ath-next v4 1/8] wifi: ath9k: return an error from a failed multi-register read
From: Nerijus Bendžiūnas <hidden>
Date: 2026-09-16 17:34:38
Also in:
lkml, stable
Subsystem:
atheros ath generic utilities, qualcomm atheros ath9k wireless driver, the rest · Maintainers:
Jeff Johnson, Toke Høiland-Jørgensen, Linus Torvalds
ath9k_multi_regread() logs a failed or timed-out WMI read and still
copies its result buffer to the caller, so the caller gets
uninitialised stack data for every register it asked for. The MIB
counters in ath9k_hw_update_mibstats() then take arbitrary jumps, and
an EEPROM read at probe fails on the checksum rather than on the read.
Give the multi_read op a return value, return the WMI error from
ath9k_multi_regread(), and check it: skip the counter update and fail
the EEPROM fill when the read did not happen.
Fixes: 09a525d33870 ("ath9k_htc: Add multiple register read API")
Assisted-by: LLM
Signed-off-by: Nerijus Bendžiūnas <redacted>
---
drivers/net/wireless/ath/ath.h | 2 +-
drivers/net/wireless/ath/ath9k/ani.c | 4 +++-
drivers/net/wireless/ath/ath9k/eeprom.c | 10 +++++++---
drivers/net/wireless/ath/ath9k/eeprom.h | 2 +-
drivers/net/wireless/ath/ath9k/eeprom_4k.c | 4 +---
drivers/net/wireless/ath/ath9k/eeprom_9287.c | 7 +++----
drivers/net/wireless/ath/ath9k/eeprom_def.c | 5 ++---
drivers/net/wireless/ath/ath9k/htc_drv_init.c | 7 +++++--
drivers/net/wireless/ath/ath9k/init.c | 6 ++++--
9 files changed, 27 insertions(+), 20 deletions(-)
diff --git a/drivers/net/wireless/ath/ath.h b/drivers/net/wireless/ath/ath.h
index 34654f710d8a..d1af0b81768a 100644
--- a/drivers/net/wireless/ath/ath.h
+++ b/drivers/net/wireless/ath/ath.h@@ -126,7 +126,7 @@ enum ath_cipher { */ struct ath_ops { unsigned int (*read)(void *, u32 reg_offset); - void (*multi_read)(void *, u32 *addr, u32 *val, u16 count); + int (*multi_read)(void *hw_priv, u32 *addr, u32 *val, u16 count); void (*write)(void *, u32 val, u32 reg_offset); void (*enable_write_buffer)(void *); void (*write_flush) (void *);
diff --git a/drivers/net/wireless/ath/ath9k/ani.c b/drivers/net/wireless/ath/ath9k/ani.c
index 41d192709e8e..6d9f0ee26237 100644
--- a/drivers/net/wireless/ath/ath9k/ani.c
+++ b/drivers/net/wireless/ath/ath9k/ani.c@@ -111,7 +111,9 @@ static void ath9k_hw_update_mibstats(struct ath_hw *ah, AR_FCS_FAIL, AR_BEACON_CNT}; u32 data[5]; - REG_READ_MULTI(ah, &addr[0], &data[0], 5); + if (REG_READ_MULTI(ah, &addr[0], &data[0], 5)) + return; + /* AR_RTS_OK */ stats->rts_good += data[0]; /* AR_RTS_FAIL */
diff --git a/drivers/net/wireless/ath/ath9k/eeprom.c b/drivers/net/wireless/ath/ath9k/eeprom.c
index df58dc02e104..6bf86d017c13 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom.c@@ -76,7 +76,7 @@ bool ath9k_hw_get_lower_upper_index(u8 target, u8 *pList, u16 listSize, return false; } -void ath9k_hw_usb_gen_fill_eeprom(struct ath_hw *ah, u16 *eep_data, +bool ath9k_hw_usb_gen_fill_eeprom(struct ath_hw *ah, u16 *eep_data, int eep_start_loc, int size) { int i = 0, j, addr;
@@ -88,7 +88,8 @@ void ath9k_hw_usb_gen_fill_eeprom(struct ath_hw *ah, u16 *eep_data, ((addr + eep_start_loc) << AR5416_EEPROM_S); i++; if (i == 8) { - REG_READ_MULTI(ah, addrdata, data, i); + if (REG_READ_MULTI(ah, addrdata, data, i)) + return false; for (j = 0; j < i; j++) { *eep_data = data[j];
@@ -99,13 +100,16 @@ void ath9k_hw_usb_gen_fill_eeprom(struct ath_hw *ah, u16 *eep_data, } if (i != 0) { - REG_READ_MULTI(ah, addrdata, data, i); + if (REG_READ_MULTI(ah, addrdata, data, i)) + return false; for (j = 0; j < i; j++) { *eep_data = data[j]; eep_data++; } } + + return true; } static bool ath9k_hw_nvram_read_array(u16 *blob, size_t blob_size,
diff --git a/drivers/net/wireless/ath/ath9k/eeprom.h b/drivers/net/wireless/ath/ath9k/eeprom.h
index f1cde43fcb55..dc5ad4a3e752 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom.h
+++ b/drivers/net/wireless/ath/ath9k/eeprom.h@@ -680,7 +680,7 @@ bool ath9k_hw_nvram_read(struct ath_hw *ah, u32 off, u16 *data); int ath9k_hw_nvram_swap_data(struct ath_hw *ah, bool *swap_needed, int size); bool ath9k_hw_nvram_validate_checksum(struct ath_hw *ah, int size); bool ath9k_hw_nvram_check_version(struct ath_hw *ah, int version, int minrev); -void ath9k_hw_usb_gen_fill_eeprom(struct ath_hw *ah, u16 *eep_data, +bool ath9k_hw_usb_gen_fill_eeprom(struct ath_hw *ah, u16 *eep_data, int eep_start_loc, int size); void ath9k_hw_fill_vpd_table(u8 pwrMin, u8 pwrMax, u8 *pPwrList, u8 *pVpdList, u16 numIntercepts,
diff --git a/drivers/net/wireless/ath/ath9k/eeprom_4k.c b/drivers/net/wireless/ath/ath9k/eeprom_4k.c
index 3e16cfe059f3..d5a8275ceb03 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom_4k.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom_4k.c@@ -53,9 +53,7 @@ static bool __ath9k_hw_usb_4k_fill_eeprom(struct ath_hw *ah) { u16 *eep_data = (u16 *)&ah->eeprom.map4k; - ath9k_hw_usb_gen_fill_eeprom(ah, eep_data, 64, SIZE_EEPROM_4K); - - return true; + return ath9k_hw_usb_gen_fill_eeprom(ah, eep_data, 64, SIZE_EEPROM_4K); } static bool ath9k_hw_4k_fill_eeprom(struct ath_hw *ah)
diff --git a/drivers/net/wireless/ath/ath9k/eeprom_9287.c b/drivers/net/wireless/ath/ath9k/eeprom_9287.c
index c139ac49ccf6..73213416fc8c 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom_9287.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom_9287.c@@ -55,10 +55,9 @@ static bool __ath9k_hw_usb_ar9287_fill_eeprom(struct ath_hw *ah) { u16 *eep_data = (u16 *)&ah->eeprom.map9287; - ath9k_hw_usb_gen_fill_eeprom(ah, eep_data, - AR9287_HTC_EEP_START_LOC, - SIZE_EEPROM_AR9287); - return true; + return ath9k_hw_usb_gen_fill_eeprom(ah, eep_data, + AR9287_HTC_EEP_START_LOC, + SIZE_EEPROM_AR9287); } static bool ath9k_hw_ar9287_fill_eeprom(struct ath_hw *ah)
diff --git a/drivers/net/wireless/ath/ath9k/eeprom_def.c b/drivers/net/wireless/ath/ath9k/eeprom_def.c
index 5ba467cb7425..085e544f7c4b 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom_def.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom_def.c@@ -112,9 +112,8 @@ static bool __ath9k_hw_usb_def_fill_eeprom(struct ath_hw *ah) { u16 *eep_data = (u16 *)&ah->eeprom.def; - ath9k_hw_usb_gen_fill_eeprom(ah, eep_data, - 0x100, SIZE_EEPROM_DEF); - return true; + return ath9k_hw_usb_gen_fill_eeprom(ah, eep_data, + 0x100, SIZE_EEPROM_DEF); } static bool ath9k_hw_def_fill_eeprom(struct ath_hw *ah)
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
index 6de78ae85726..3798d3375158 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c@@ -252,8 +252,8 @@ static unsigned int ath9k_regread(void *hw_priv, u32 reg_offset) return be32_to_cpu(val); } -static void ath9k_multi_regread(void *hw_priv, u32 *addr, - u32 *val, u16 count) +static int ath9k_multi_regread(void *hw_priv, u32 *addr, + u32 *val, u16 count) { struct ath_hw *ah = hw_priv; struct ath_common *common = ath9k_hw_common(ah);
@@ -273,11 +273,14 @@ static void ath9k_multi_regread(void *hw_priv, u32 *addr, if (unlikely(ret)) { ath_dbg(common, WMI, "Multiple REGISTER READ FAILED (count: %d)\n", count); + return ret; } for (i = 0; i < count; i++) { val[i] = be32_to_cpu(tmpval[i]); } + + return 0; } static void ath9k_regwrite_multi(struct ath_common *common)
diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
index 2f0c4ef86b7e..e425d355bf94 100644
--- a/drivers/net/wireless/ath/ath9k/init.c
+++ b/drivers/net/wireless/ath/ath9k/init.c@@ -201,13 +201,15 @@ static unsigned int ath9k_ioread32(void *hw_priv, u32 reg_offset) return val; } -static void ath9k_multi_ioread32(void *hw_priv, u32 *addr, - u32 *val, u16 count) +static int ath9k_multi_ioread32(void *hw_priv, u32 *addr, + u32 *val, u16 count) { int i; for (i = 0; i < count; i++) val[i] = ath9k_ioread32(hw_priv, addr[i]); + + return 0; }
--
2.55.0