[PATCH v4 0/3] wifi: nxpwifi: fix the 11AX_CFG response handler

[Yehyeong Lee]

This supersedes

  [PATCH v3 0/3] wifi: nxpwifi: fix the 11AX_CFG response handler
  <20261016042542.773945-1-yhlee@xxxxxxxxxxxxxxxxxx>

which should be dropped.  Apologies for the churn on v1 to v3; this one is
meant to be the last.

Three fixes in nxpwifi_ret_11ax_cfg() and, for patch 1, its two siblings.
The order matters.  On the base the extension ID is read one byte too far
in, so a correctly formatted capability TLV is never recognised and the
unguarded store patch 1 closes is never reached.  Patch 2 is what makes it
reachable, so patch 1 goes first.

The driver has not appeared in a released kernel, so no patch has a stable
tag.

Changes in v4
- patch 3 selects the destination buffer by band first and validates that
  one, instead of checking both unconditionally.
- the three commit messages are cut down to the issue, the path and the
  fix.

Still open, and not addressed here.  Patch 1 closes the window where the
response path reads curr_cmd->data_buf after nxpwifi_wait_queue_complete()
cleared it, but not the one where it read the field first and holds a
valid pointer in a local while the waiter returns and reuses the frame,
because nxpwifi_process_cmdresp() reads the field without
nxpwifi_cmd_lock and calls the handler outside it.  That is the lifetime
contract between a cancelled command and a late response rather than this
driver's 11ax code, mwifiex is in the same position, and I am not sending
a patch for it.

Testing.  I have no IW61x hardware.  A KUnit harness injects a fabricated
command response into nxpwifi_ret_11ax_cfg() on a KASAN kernel, 12 cases,
each in its own boot, with the TLVs in the wire format the send side of
this command produces; it says nothing about what the firmware emits.  The
base gives 6 ok and 6 not ok with 2 KASAN reports, the base plus patches 1
and 2 gives 6 ok and 6 not ok with 6 reports, and the full series gives 12
ok with none.

Yehyeong Lee (3):
  wifi: nxpwifi: guard the 11ax response handlers against a detached
    command buffer
  wifi: nxpwifi: read the 11AX_CFG extension ID at the right offset
  wifi: nxpwifi: bound the TLV lengths in the 11AX_CFG response

 drivers/net/wireless/nxp/nxpwifi/11ax.c | 67 ++++++++++++++++++-------
 1 file changed, 48 insertions(+), 19 deletions(-)


base-commit: 3d229ce89862b8e82d71a9e11d6f840ca272a6d6
-- 
2.43.0