From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pz2-f12.google.com (mail-pz2-f12.google.com [74.125.228.12]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 84FCD43DEA0 for ; Mon, 21 Sep 2026 07:42:10 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.228.12 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789976532; cv=none; b=Dvb6EaG66aZlcZR/OCmLTTVb4+mFB+H4hcgiZPhwhqlwq9QnUb8lnrMsGWfatgvSWLrzzyuDKx8Xz/7Dn1ylGN8aS8oec0iVMWlsNqhjjhP0Zle/hR2AynbbJ0JJZRUwy8RDhSa+iPvFGkj76LB0baBboYy8l3UK7Vfj1CT2CLY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789976532; c=relaxed/simple; bh=+PxWiJGd3qQeg3qY9tqhXy5GvpqL3o3G+lizbAofHcI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=GgT8A3ttYMp4LrecqliVRkhb23V3YWaRCzeHA8fs6fH1V0LeP2vnloiiBO3UFUFpH+APVm+4uEK5YWesax24iWzfwd/NUMMO6gAYDwJNkl3nhblIq2dEOijSkKZZa8n7mEUtFbVpwXXK9yK5W9M8+aka+ewxahs9KeZ0WoXu+Qg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=qtIfeI5A; arc=none smtp.client-ip=74.125.228.12 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="qtIfeI5A" Received: by mail-pz2-f12.google.com with SMTP id 41be03b00d2f7-cc1cea50db3so1557298a12.1 for ; Mon, 21 Sep 2026 00:42:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1789976529; x=1790581329; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=EHgcYtuYemojMdrCO9G6C1IAVKzr+T0NM2HjgpZp/nc=; b=qtIfeI5An/RpD16yzxCT1Sak7grlDcQirLRhUl+uXA4hCdgX1i7mKrpnzOFy5GE9NJ RktAx2RAXnQqqzMZCbNQ+T0yTTce9MmmGrp60VIcqKKflKepAHm3D3TiuvvAFhl+b9XN /eNaY0ZfsR2aff/1vDG0Ylq3eEQ/5jnKdHH8LZ+vFuQoz4Q3pQetRAvL8AyBj09vS9VV kCDtsbeO7ikh3JqnZ/i88YkrZzkVMDLMRGoMUw6eK2e70QjbKh54Mlg7XbPfbQQdoHPE h/xkA7YDYNMe4MkuaONiJgKpXX+136teBj2PAcNbVkglT2TWilmFb4TSivmvVuAKPtnT Jzkg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1789976529; x=1790581329; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=EHgcYtuYemojMdrCO9G6C1IAVKzr+T0NM2HjgpZp/nc=; b=zfXdQ9j7UbwO/VHSYTo9sOMbqkBMnl53K9EcMsFF+PBz+5ueoSIcIRhWRMReX5i6nQ 08rTxAtl6ZNff/oP6/HGbq0BbBJK+/TLLSHRbEsFCiOUD9s4smxFSKiPK4aoaDSGMG6J EJpAc07xnXpNEpLB4y0fHiMALjVc1tvCcRD1CGJD2JdQgEK2tRHM6XPSrIIGsm7FxMmU /ZkX0kLrvoX4/D0zcmm+TqzZpkY1jSXc+3nF5whcxPrsTblMwIy7zkmMoPbOjwJVIyab tnY8XAE6yXlckwYcXdfOMWKZoTnMUDCoIJu4e6Hnp1KvhRFaKyHFSVD+AAdv2aCpagrk IECQ== X-Forwarded-Encrypted: i=1; AKwUvBzLgifirepWDt8JSG8J+r3LfemhokYrCmyyn/olNIpe1PYcF7sg73hPJPqM1eHZX3/IDEitfvgsXcfgV4M=@vger.kernel.org X-Gm-Message-State: AFuF++lumG40flfTjfZhRCakbwBVCaLuxmFsNOJOsUsd5g2P5gniNv2Y p8lKmss8utKsWkjTTEof7lJorMW2i96/xfFUs4KKSM/+eQf0PwLkBg+L X-Gm-Gg: AYBFou0fiFaJqsKoELkGUUQh88t096nyCHBMCvyCzCkrof40iNNKrlIUpj/dBH2W3PW IOx3kmUJ2fT8GB0Flw8Pf/jxT+1VZWW2j0DcVhGO3Q+GifMJsBP6wePR2TRj5i42tbCArSp7954 ws5XFs3YKhqViZZeCV9YK8PURcLOr0jLMJUbD5c34oe6CP3MIEEBznAC3v1gDg0dyjUtmUkAu6i DwbKghyiU22favKbYU8I+90IEX+ja7UQc6BM7A9jdjfWv0gm2zdPOaoHM21oPZlDtInxIOXEp7L lox/g38laab+9Sa2sP+QuijTvdxusAUPg2kNxg+104n+2wqUzMXzQ0tSvagZ45bflkeupamm9fZ phRS9sVGMpo1mhlPDfh4soiCtwORfHtJi9iu24xXQjWq5TwlVsMvJQaTfG51a3pZE3bFENVHgRU J86+SEtqTbtPEHHLWAQog6seffNO9CC8LQnTQ9dXN9knwVmu2fAKslK6HML0yuuZcjrzHu/MGIB uAzJXLTID3uB2mgNG7FXm6gIYZlyNHgYuY53av6GlkOpAf8mQdjZkSsJd6RUbcshKOpbjGGnSIE zzd8jImHDA== X-Received: by 2002:a05:6a20:9c8c:b0:3dd:85a9:559d with SMTP id adf61e73a8af0-3dd8c57fe0emr17599249637.31.1789976529153; Mon, 21 Sep 2026 00:42:09 -0700 (PDT) Received: from phui-2.c.googlers.com.com (78.123.83.34.bc.googleusercontent.com. [34.83.123.78]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-cc72ae70637sm3048650a12.6.2026.09.21.00.42.08 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 21 Sep 2026 00:42:08 -0700 (PDT) From: Hui Peng To: Alexander Aring , Miquel Raynal , Stefan Schmidt Cc: linux-wpan@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Hui Peng , stable@vger.kernel.org Subject: [PATCH net v2 3/4] ieee802154: mcr20a: drop corrupted RX frames instead of reading 125 stale bytes Date: Mon, 21 Sep 2026 07:42:06 +0000 Message-ID: <20260921074207.2289391-3-benquike@gmail.com> X-Mailer: git-send-email 2.55.0.1082.g2b9226bbc0-goog In-Reply-To: <20260919213639.3316625-1-benquike@gmail.com> References: <20260919213639.3316625-1-benquike@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit In mcr20a_handle_rx_read_buf_complete(), when !ieee802154_is_valid_psdu_len(len) is true, the driver overwrites len with IEEE802154_MTU (127) and copies 125 bytes from lp->rx_buf into a new skb even though only the original len bytes were transferred over SPI, reading past the valid RX data and leaking up to 125 bytes of stale heap memory to the network stack: BUG: KASAN: slab-out-of-bounds in mcr20a_handle_rx_read_buf_complete.constprop.0+0x91/0xc0 Read of size 125 at addr ffff888002853f40 by task init/1 Call Trace: dump_stack_lvl+0x70/0xa0 print_report+0x153/0x4c6 kasan_report+0xf1/0x120 kasan_check_range+0x125/0x200 __asan_memcpy+0x23/0x60 mcr20a_handle_rx_read_buf_complete.constprop.0+0x91/0xc0 ... The buggy address belongs to the object at ffff888002853f40 which belongs to the cache kmalloc-8 of size 8 The buggy address is located 0 bytes inside of allocated 4-byte region [ffff888002853f40, ffff888002853f44) Drop the corrupted frame, re-arm reception via mcr20a_request_rx(lp), and return early. Tested in QEMU with KASAN enabled by passing a corrupted 4-byte RX frame length to mcr20a_handle_rx_read_buf_complete(). Fixes: 8c6ad9cc5157 ("ieee802154: Add NXP MCR20A IEEE 802.15.4 transceiver driver") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Hui Peng --- Changes in v2: - Split out as patch 3/4 covering only the mcr20a RX corrupted frame handling as requested by Miquel Raynal. drivers/net/ieee802154/mcr20a.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/ieee802154/mcr20a.c b/drivers/net/ieee802154/mcr20a.c index 020d392a98b6..d01b277d33d2 100644 --- a/drivers/net/ieee802154/mcr20a.c +++ b/drivers/net/ieee802154/mcr20a.c @@ -790,7 +790,8 @@ mcr20a_handle_rx_read_buf_complete(void *context) if (!ieee802154_is_valid_psdu_len(len)) { dev_vdbg(&lp->spi->dev, "corrupted frame received\n"); - len = IEEE802154_MTU; + mcr20a_request_rx(lp); + return; } len = len - 2; /* get rid of frame check field */ -- 2.47.3