[PATCH wireless-next 0/3] wifi: nxpwifi: harden the VDLL download path

The VDLL download path acts on an event the firmware sends, and on the
lengths that event carries, without checking either.  Reading through it
turned up three problems:

  - the ten-byte event header is dereferenced without checking that the
    event is long enough to hold it;

  - the block length the event carries is clamped only against the size
    of the VDLL image, not against the 2048-byte command buffer the
    block is copied into;

  - the error path taken for an oversized VDLL image keeps the firmware
    file pinned for the lifetime of the adapter.

Patch 2 is the one that matters most.  msg_len is a u16, so a block
length near 65535 wraps it to a small value: the skb is grown by a few
bytes and the memcpy() that follows still writes block_len bytes past
the end of the command buffer.

The three are independent, but they all touch util.c and apply in
order.

Found by inspection; there is no IW61x hardware here to test on.

Linmao Li (3):
  wifi: nxpwifi: validate the length of the VDLL indication event
  wifi: nxpwifi: reject VDLL blocks that do not fit the command buffer
  wifi: nxpwifi: release the firmware when the VDLL image does not fit

 drivers/net/wireless/nxp/nxpwifi/util.c | 31 ++++++++++++++++++++-----
 1 file changed, 25 insertions(+), 6 deletions(-)

-- 
2.25.1