[PATCH V3] ath10k: allocate small size dma memory in ath10k_pci_diag_write_mem

is to allocate a small size dma memory. In the loop, driver copies the data to the allocated dma memory and writes to the destination until all the data is written. Tested with QCA6174 PCI with firmware-6.bin_WLAN.RM.4.4.1-00119-QCARMSWP-1, this also affects QCA9377 PCI. Signed-off-by: Carl Huang Rev

[PATCH V2] ath10k: allocate small size dma memory in ath10k_pci_diag_write_mem

is to allocate a small size dma memory. In the loop, driver copies the data to the allocated dma memory and writes to the destination until all the data is written. Tested with QCA6174 PCI with firmware-6.bin_WLAN.RM.4.4.1-00119-QCARMSWP-1, this also affects QCA9377 PCI. Signed-off-by: Carl Huang Rev

[PATCH] ath10k: allocate small size dma memory in ath10k_pci_diag_write_mem

is to allocate a small size dma memory. In the loop, driver copies the data to the allocated dma memory and writes to the destination until all the data is written. Tested with QCA6174 PCI with firmware-6.bin_WLAN.RM.4.4.1-00119-QCARMSWP-1, this also affects QCA9377 PCI. Signed-off-by: Carl

Re: [PATCH 3/3] ath10k: download firmware via diag Copy Engine for QCA6174 and QCA9377.

On 2018-09-22 08:53, Brian Norris wrote: Hi again! One last (?) comment: On Thu, Aug 30, 2018 at 10:29:42AM +0800, Carl Huang wrote: diff --git a/drivers/net/wireless/ath/ath10k/hw.c b/drivers/net/wireless/ath/ath10k/hw.c index 677535b..25ee1c6 100644 --- a/drivers/net/wireless/ath/ath10k

[PATCH 1/2] ath10k: Add WMI_SERVICE_AVAILABLE_EVENT support

-off-by: Alan Liu Signed-off-by: Carl Huang --- drivers/net/wireless/ath/ath10k/wmi-ops.h | 24 +++ drivers/net/wireless/ath/ath10k/wmi-tlv.c | 38 drivers/net/wireless/ath/ath10k/wmi-tlv.h | 346 +- drivers/net/wireless/ath/ath10k/wmi.c | 21 +- drivers/net

[PATCH 0/2] ath10k: support MAC address randomization in scan

The feature MAC address randomization depends on the firmware capability, if the firmware indicates WMI_SERVICE_SPOOF_MAC_SUPPORT service the host driver will report it to upper layer. The service bit is above the 128 bit limit so a new service check macro is needed. Carl Huang (2): ath10k: Add

[PATCH 2/2] ath10k: support MAC address randomization in scan

-1, but QCA9377 is also affected. Signed-off-by: Carl Huang --- drivers/net/wireless/ath/ath10k/mac.c | 17 + drivers/net/wireless/ath/ath10k/wmi-ops.h | 22 ++ drivers/net/wireless/ath/ath10k/wmi-tlv.c | 25 + drivers/net/wireless

[PATCH v2] ath10k: fix use-after-free in ath10k_wmi_cmd_send_nowait

this parameter too. Signed-off-by: Carl Huang --- drivers/net/wireless/ath/ath10k/trace.h | 12 drivers/net/wireless/ath/ath10k/wmi.c | 2 +- 2 files changed, 5 insertions(+), 9 deletions(-) diff --git a/drivers/net/wireless/ath/ath10k/trace.h b/drivers/net/wireless/ath/ath10k

RE: [PATCH] ath10k: fix use-after-free in ath10k_wmi_cmd_send_nowait

> -Original Message- > From: ath10k [mailto:ath10k-boun...@lists.infradead.org] On Behalf Of Felix > Fietkau > Sent: Sunday, February 11, 2018 5:59 PM > To: Carl Huang ; ath...@lists.infradead.org > Cc: linux-wireless@vger.kernel.org > Subject: Re: [PATCH] ath10k:

[PATCH] ath10k: fix use-after-free in ath10k_wmi_cmd_send_nowait

The skb may be freed in tx completion context before trace_ath10k_wmi_cmd is called. This can be easily captured when KASAN(Kernel Address Sanitizer) is enabled. The fix is to add a reference count to the skb and release it after trace_ath10k_wmi_cmd is called. Signed-off-by: Carl Huang

[PATCH] ath10k: fix use-after-free in ath10k_wmi_cmd_send_nowait

The skb may be freed in tx completion context before trace_ath10k_wmi_cmd is called. This can be easily captured when KASAN(Kernel Address Sanitizer) is enabled. The fix is to add a reference count to the skb and release it after trace_ath10k_wmi_cmd is called. Signed-off-by: Carl Huang