The VDLL download path acts on an event the firmware sends, and on the
lengths that event carries, without checking either.  Reading through it
turned up three problems:

  - the ten-byte event header is dereferenced without checking that the
    event is long enough to hold it;

  - the block length the event carries is clamped only against the size
    of the VDLL image, not against the 2048-byte command buffer the
    block is copied into;

  - the error path taken for an oversized VDLL image keeps the firmware
    file pinned for the lifetime of the adapter.

Patch 2 is the one that matters most.  msg_len is a u16, so a block
length near 65535 wraps it to a small value: the skb is grown by a few
bytes and the memcpy() that follows still writes block_len bytes past
the end of the command buffer.

The three are independent, but they all touch util.c and apply in
order.

Found by inspection; there is no IW61x hardware here to test on.

Linmao Li (3):
  wifi: nxpwifi: validate the length of the VDLL indication event
  wifi: nxpwifi: reject VDLL blocks that do not fit the command buffer
  wifi: nxpwifi: release the firmware when the VDLL image does not fit

 drivers/net/wireless/nxp/nxpwifi/util.c | 31 ++++++++++++++++++++-----
 1 file changed, 25 insertions(+), 6 deletions(-)

-- 
2.25.1