[PATCH v2 0/2] wifi: nxpwifi: bound the 11AX_CFG response handler

[Yehyeong Lee]

This supersedes

  [PATCH] wifi: nxpwifi: bound the TLV lengths in the 11AX_CFG response
  <20261016014927.434473-1-yhlee@xxxxxxxxxxxxxxxxxx>

which should be dropped.  That patch is patch 2 here, unchanged.

Review of it pointed out that the handler also dereferences the command
buffer without checking it, which is a separate problem in the same
function, so v2 is two patches.

 1  nxpwifi_wait_queue_complete() detaches data_buf when a synchronous
    command is interrupted, because the caller may be about to release a
    stack-allocated buffer.  nxpwifi_process_cmdresp() hands the field to
    the response handler as it finds it, and this handler stores through
    it without looking, so a late response oopses.  Check it, the way the
    other response handlers here already do.
 2  the TLV walk takes its length from the response and bounds neither
    the walk nor the two copies, so a short response wraps the u16 length
    and an oversized header->len runs past both destinations.

The driver has not appeared in a released kernel, so neither patch has a
stable tag.

I have no IW61x hardware.  Patch 2 was exercised by injecting the lengths
through a KUnit harness on a KASAN kernel, which reaches past both
destinations without the patch and nothing with it, and still accepts a
TLV that fills them exactly.  Patch 1 is from the code: the detach, the
pass-through and the store are all in the tree, and the KUnit case for it
only confirms that the guard returns -EINVAL, since the unguarded store
takes the test kernel down.  Neither patch claims a reachable
out-of-bounds; the firmware's behaviour is not something the tree
answers.

v1 -> v2:
- new patch 1: reject a NULL command buffer before using it.
- patch 2 is v1 with no change, rebased onto patch 1.

Yehyeong Lee (2):
  wifi: nxpwifi: reject a NULL command buffer in the 11AX_CFG response
    handler
  wifi: nxpwifi: bound the TLV lengths in the 11AX_CFG response

 drivers/net/wireless/nxp/nxpwifi/11ax.c | 26 ++++++++++++++++++++++---
 1 file changed, 23 insertions(+), 3 deletions(-)


base-commit: 2f2f7eeef8b0a1a9b9ca998231419873ccae8d4e
-- 
2.43.0