[PATCH wireless 0/3] wifi: nxpwifi: validate firmware response sizes

[Tristan Madani <tristmd@gmail.com>]

From: Tristan Madani <tristan@talencesecurity.com>

nxpwifi inherits several patterns from mwifiex where firmware-provided
lengths and counts are used to bound loops and copies without
validation against the actual response buffer size.  A malformed
firmware response can cause reads past the buffer.

This series adds bounds checks to three such paths:

  1/3 - HE capability TLV length in 11ax config response
  2/3 - ext_scan buf_size against event buffer length
  3/3 - command response size against response skb length

All three were introduced with the driver in 73b01e57ed3e ("wifi: nxp:
add nxpwifi driver for IW61x").

Tristan Madani (3):
  wifi: nxpwifi: validate HE capability TLV length in firmware response
  wifi: nxpwifi: validate ext_scan buf_size against event buffer length
  wifi: nxpwifi: validate command response size against buffer length

 drivers/net/wireless/nxp/nxpwifi/11ax.c   |  3 +++
 drivers/net/wireless/nxp/nxpwifi/scan.c   |  9 +++++++++
 drivers/net/wireless/nxp/nxpwifi/cmdevt.c | 14 ++++++++++++++
 3 files changed, 26 insertions(+)

-- 
2.47.3