[PATCH 6.6.y 0/2] wifi: ath12k: fix M3 buffer reuse in my CVE-2024-40979 backport

[Artem Dinaburg <artem@trailofbits.com>]

Hi Greg, Sasha, and ath12k maintainers,

My backport of 05090ae82f44 ("wifi: ath12k: check M3 buffer size as well
whey trying to reuse it"), which landed in 6.6.158 as 9a38ba5561d9, does
not match upstream. When the existing M3 buffer is large enough, it
returns early without copying the new image or updating its length.
Upstream copies the current image into the reused buffer every time. In
6.6.y, recovery or resume therefore keeps the old M3 image unless the new
one is larger.

Restoring the copy needs one more upstream fix first. Once a smaller
image can be copied into the buffer, m3_mem->size can shrink below the
allocation size, and that shrunken size is later passed to
dma_free_coherent(). Upstream fixed this in 00575bb44b2c ("wifi: ath12k:
fix reusing m3 memory") by tracking the allocation size separately.

  1/2 backports 00575bb44b2c.
  2/2 fixes my backport by restoring the upstream copy on reuse. It has
      no upstream equivalent; upstream never had the early return.

6.12.y already copies on reuse but lacked 00575bb44b2c; my backport of
it is now queued for 6.12.y. 6.18.y and 7.2.y already have the fix, and
6.1.y has no ath12k driver.

Testing: both patches apply to v6.6.158 and on top of the current 6.6
stable queue. An x86_64 allmodconfig build with CONFIG_WERROR=y is clean,
and ath12k also builds cleanly with W=1. I tested ath12k_qmi_m3_load()
and ath12k_qmi_m3_free() in userspace with firmware and DMA stubs under
ASan/UBSan, covering same-size, smaller, and larger replacement images,
plus allocation and firmware-request failures. I did not test on ath12k
hardware.

Previous series: https://lore.kernel.org/all/20260929025856.85683-1-artem@trailofbits.com/

An LLM helped compare the backport with upstream, prepare these patches,
and build and test them. I reviewed the results.

Thanks,
Artem Dinaburg

Artem Dinaburg (1):
  wifi: ath12k: copy M3 firmware when reusing the buffer

Baochen Qiang (1):
  wifi: ath12k: fix reusing m3 memory