[PATCH v2 1/2] wifi: nxpwifi: reject a NULL command buffer in the 11AX_CFG response handler

[Yehyeong Lee]

nxpwifi_ret_11ax_cfg() writes the parsed HE capability through the
data_buf the command was issued with, and never checks that it is still
there.

It may not be. When a synchronous command is interrupted,
nxpwifi_wait_queue_complete() detaches the buffer because the caller is
about to go out of scope:

	/*
	 * The response path writes through cmd_node->data_buf. The
	 * caller can release a stack-allocated data_buf after an
	 * interrupted wait while a late response is still pending.
	 * Detach it from the current command before returning.
	 */
	spin_lock_bh(&adapter->nxpwifi_cmd_lock);
	if (adapter->curr_cmd == cmd_queued)
		adapter->curr_cmd->data_buf = NULL;

A response that arrives after that still reaches
nxpwifi_process_cmdresp(), which reads the field and hands it to the
handler as it finds it:

	void *data_buf = adapter->curr_cmd->data_buf;

	ret = adapter->curr_cmd->cmd_resp(priv, resp, cmdresp_no, data_buf);

The handler then takes the address of a member of that pointer and stores
through it, so a response carrying an HE capability TLV writes a few
bytes at a low fixed address and the kernel oopses.
nxpwifi_set_11ax_status() issues this command synchronously from the AP
start path, which is where an interrupted wait comes from.

Check the buffer first, the way the other response handlers in this
driver already do -- nxpwifi_ret_sta_802_11_snmp_mib() stores only "if
(data_buf)" and nxpwifi_ret_sta_reg_access() returns early on
"!data_buf".

This is a local denial of service: it needs a command whose wait is
interrupted and a response that arrives late, both on the local host.

Fixes: 73b01e57ed3e ("wifi: nxp: add nxpwifi driver for IW61x")
Signed-off-by: Yehyeong Lee <yhlee@xxxxxxxxxxxxxxxxxx>
---
 drivers/net/wireless/nxp/nxpwifi/11ax.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/nxp/nxpwifi/11ax.c b/drivers/net/wireless/nxp/nxpwifi/11ax.c
index 96540914f3cf6..1665bd514596e 100644
--- a/drivers/net/wireless/nxp/nxpwifi/11ax.c
+++ b/drivers/net/wireless/nxp/nxpwifi/11ax.c
@@ -205,9 +205,13 @@ int nxpwifi_ret_11ax_cfg(struct nxpwifi_private *priv,
 	struct host_cmd_11ax_cfg *he_cfg = &resp->params.ax_cfg;
 	struct nxpwifi_ie_types_header *header;
 	u16 left_len, tlv_type, tlv_len;
+	struct nxpwifi_11ax_he_cap_cfg *he_cap;
 	u8 ext_id;
-	struct nxpwifi_11ax_he_cap_cfg *he_cap = &ax_cfg->he_cap_cfg;
 
+	if (!ax_cfg)
+		return -EINVAL;
+
+	he_cap = &ax_cfg->he_cap_cfg;
 	left_len = le16_to_cpu(resp->size) - sizeof(*he_cfg) - S_DS_GEN;
 	header = (struct nxpwifi_ie_types_header *)he_cfg->tlv;
 
-- 
2.43.0