[PATCH v3 2/2] wifi: ath9k_htc: refuse a command that fills whole USB packets

[Nerijus Bendžiūnas]

The firmware ends a command on the interrupt OUT endpoint only when a
packet is shorter than 64 bytes (usb_reg_out_patch() in
open-ath9k-htc-firmware). The one such command this driver can
produce, 192 bytes, was never delivered: the device stopped answering
WMI and stayed dead through a warm reboot until power was removed.

Nothing in the driver checks for this. Check the length in
hif_usb_send_regout(), where the packet size is known, and refuse the
command with a warning. The command then fails the way any other WMI
command failure does: ath9k_wmi_cmd() frees the buffer and returns
the error.

Assisted-by: LLM
Signed-off-by: Nerijus Bendžiūnas <nerijus.bendziunas@xxxxxxxxx>
---
New in v3.

 drivers/net/wireless/ath/ath9k/hif_usb.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
index d3491ff08e6e..49303c7e3fef 100644
--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
+++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
@@ -99,10 +99,17 @@ static void hif_usb_regout_cb(struct urb *urb)
 static int hif_usb_send_regout(struct hif_device_usb *hif_dev,
 			       struct sk_buff *skb)
 {
+	u16 maxpacket = usb_maxpacket(hif_dev->udev,
+				      usb_sndintpipe(hif_dev->udev,
+						     USB_REG_OUT_PIPE));
 	struct urb *urb;
 	struct cmd_buf *cmd;
 	int ret = 0;
 
+	if (WARN_ONCE(maxpacket && skb->len % maxpacket == 0,
+		      "%u-byte command fills whole USB packets\n", skb->len))
+		return -EINVAL;
+
 	urb = usb_alloc_urb(0, GFP_KERNEL);
 	if (urb == NULL)
 		return -ENOMEM;
-- 
2.55.0