@@ -310,7 +310,7 @@ ath11k_pull_mac_phy_cap_svc_ready_ext(struct ath11k_pdev_wmi *wmi_handle,
if (phy_id >= hal_reg_caps->num_phy)
return -EINVAL;
- mac_phy_caps = &wmi_mac_phy_caps[phy_idx];
+ mac_phy_caps = wmi_mac_phy_caps + phy_idx;
pdev->pdev_id = mac_phy_caps->pdev_id;
pdev_cap->supported_bands = mac_phy_caps->supported_bands;
@@ -2959,6 +2959,15 @@ static int ath11k_wmi_tlv_mac_phy_caps_parse(struct ath11k_base *soc,
if (svc_rdy_ext->n_mac_phy_caps >= svc_rdy_ext->tot_phy_id)
return -ENOBUFS;
+ len = min_t(u16, len, sizeof(struct wmi_mac_phy_capabilities));
+ if (!svc_rdy_ext->n_mac_phy_caps) {
+ svc_rdy_ext->mac_phy_caps = kzalloc((svc_rdy_ext->tot_phy_id) * len,
+ GFP_ATOMIC);
+ if (!svc_rdy_ext->mac_phy_caps)
+ return -ENOMEM;
+ }
+
+ memcpy(svc_rdy_ext->mac_phy_caps + svc_rdy_ext->n_mac_phy_caps, ptr, len);
svc_rdy_ext->n_mac_phy_caps++;
return 0;
}
@@ -3092,8 +3101,6 @@ static int ath11k_wmi_tlv_svc_rdy_ext_parse(struct ath11k_base *ab,
svc_rdy_ext->hw_mode_done = true;
} else if (!svc_rdy_ext->mac_phy_done) {
svc_rdy_ext->n_mac_phy_caps = 0;
- svc_rdy_ext->mac_phy_caps =
- (struct wmi_mac_phy_capabilities *)ptr;
ret = ath11k_wmi_tlv_iter(ab, ptr, len,
ath11k_wmi_tlv_mac_phy_caps_parse,
svc_rdy_ext);
@@ -3134,6 +3141,7 @@ static int ath11k_service_ready_ext_event(struct ath11k_base *ab,
return ret;
}
+ kfree(svc_rdy_ext.mac_phy_caps);
return 0;
}
@@ -2276,7 +2276,6 @@ struct wmi_hw_mode_capabilities {
#define WMI_MAX_HECAP_PHY_SIZE (3)
struct wmi_mac_phy_capabilities {
- u32 tlv_header;
u32 hw_mode_id;
u32 pdev_id;
u32 phy_id;