ath9k_multi_regread() converts the addresses and the results through fixed eight-entry arrays without checking the count it was given, so every REG_READ_MULTI() caller has to stay at or below eight to be safe over USB. Nothing says so. The only caller that exists today, ar9271_hw_pa_cal(), happens to ask for exactly eight. Give the limit a name next to REG_READ_MULTI(), size the arrays with it, and warn rather than write past them. Signed-off-by: Nerijus Bendžiūnas --- drivers/net/wireless/ath/ath9k/htc_drv_init.c | 7 +++++-- drivers/net/wireless/ath/ath9k/hw.h | 7 +++++++ 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c index 6de78ae85726..7fdec25c76ef 100644 --- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c +++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c @@ -258,10 +258,13 @@ static void ath9k_multi_regread(void *hw_priv, u32 *addr, struct ath_hw *ah = hw_priv; struct ath_common *common = ath9k_hw_common(ah); struct ath9k_htc_priv *priv = common->priv; - __be32 tmpaddr[8]; - __be32 tmpval[8]; + __be32 tmpaddr[ATH9K_MULTI_READ_MAX]; + __be32 tmpval[ATH9K_MULTI_READ_MAX]; int i, ret; + if (WARN_ON_ONCE(count > ATH9K_MULTI_READ_MAX)) + return; + for (i = 0; i < count; i++) { tmpaddr[i] = cpu_to_be32(addr[i]); } diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h index b942b8303d8f..946c4d307b91 100644 --- a/drivers/net/wireless/ath/ath9k/hw.h +++ b/drivers/net/wireless/ath/ath9k/hw.h @@ -83,6 +83,13 @@ #define REG_READ(_ah, _reg) \ (_ah)->reg_ops.read((_ah), (_reg)) +/* + * Registers a single REG_READ_MULTI() may ask for. The USB transport carries + * the addresses and the results in one WMI command each, so its buffers put a + * hard cap on the count; callers must split larger reads themselves. + */ +#define ATH9K_MULTI_READ_MAX 8 + #define REG_READ_MULTI(_ah, _addr, _val, _cnt) \ (_ah)->reg_ops.multi_read((_ah), (_addr), (_val), (_cnt)) -- 2.55.0