[PATCH v3 2/5] wifi: ath9k: name the register multi-read limit

["Nerijus Bendžiūnas" <nerijus.bendziunas@gmail.com>]

ath9k_multi_regread() converts the addresses and the results through
fixed 8-entry arrays and does not check the count it is given, so every
REG_READ_MULTI() caller has to stay at 8 or below, which nothing
states. Two callers ask for exactly 8: ar9271_hw_pa_cal() through
REG_READ_ARRAY() and ath9k_hw_usb_gen_fill_eeprom().

Define ATH9K_MULTI_READ_MAX next to REG_READ_MULTI() and size the
arrays with it. A larger count warns once and is reported as a failed
read, all ones, instead of writing past the arrays.

Assisted-by: Claude:claude-fable-5-1
Signed-off-by: Nerijus Bendžiūnas <nerijus.bendziunas@gmail.com>
---
 drivers/net/wireless/ath/ath9k/htc_drv_init.c | 9 +++++++--
 drivers/net/wireless/ath/ath9k/hw.h           | 7 +++++++
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
index f5844e9bdd2d..3d4c6f9f6e95 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
@@ -258,10 +258,15 @@ static void ath9k_multi_regread(void *hw_priv, u32 *addr,
 	struct ath_hw *ah = hw_priv;
 	struct ath_common *common = ath9k_hw_common(ah);
 	struct ath9k_htc_priv *priv = common->priv;
-	__be32 tmpaddr[8];
-	__be32 tmpval[8];
+	__be32 tmpaddr[ATH9K_MULTI_READ_MAX];
+	__be32 tmpval[ATH9K_MULTI_READ_MAX];
 	int i, ret;
 
+	if (WARN_ON_ONCE(count > ATH9K_MULTI_READ_MAX)) {
+		memset(val, 0xff, sizeof(*val) * count);
+		return;
+	}
+
 	for (i = 0; i < count; i++) {
 		tmpaddr[i] = cpu_to_be32(addr[i]);
 	}
diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
index b942b8303d8f..211d42c92796 100644
--- a/drivers/net/wireless/ath/ath9k/hw.h
+++ b/drivers/net/wireless/ath/ath9k/hw.h
@@ -83,6 +83,13 @@
 #define REG_READ(_ah, _reg) \
 	(_ah)->reg_ops.read((_ah), (_reg))
 
+/*
+ * Maximum number of registers one REG_READ_MULTI() may ask for. The ath9k_htc
+ * implementation converts the addresses and the results through fixed arrays
+ * of this size; callers must split larger reads themselves.
+ */
+#define ATH9K_MULTI_READ_MAX	8
+
 #define REG_READ_MULTI(_ah, _addr, _val, _cnt)		\
 	(_ah)->reg_ops.multi_read((_ah), (_addr), (_val), (_cnt))
 
-- 
2.55.0