* [PATCH net v3 1/3] ieee802154: ca8210: prevent stack buffer overflow in ca8210_rx_done()
2026-09-22 9:30 [PATCH net v3 0/3] ieee802154: ca8210: fix stack and slab out-of-bounds accesses Hui Peng
@ 2026-09-22 9:30 ` Hui Peng
2026-09-22 9:30 ` [PATCH net v3 2/3] ieee802154: ca8210: prevent stack buffer overflow in hwme_get_request_sync() Hui Peng
2026-09-22 9:30 ` [PATCH net v3 3/3] ieee802154: ca8210: validate data_ind length upfront in ca8210_skb_rx() Hui Peng
2 siblings, 0 replies; 5+ messages in thread
From: Hui Peng @ 2026-09-22 9:30 UTC (permalink / raw)
To: Harry Morris, Alexander Aring, Miquel Raynal, Stefan Schmidt
Cc: Hui Peng, David Laight, linux-wpan, netdev, linux-kernel, stable
In ca8210_spi_transfer(), each SPI transfer reads
sizeof(struct mac_message) bytes into cas_ctl->tx_in_buf:
cas_ctl->transfer.len = sizeof(struct mac_message);
However, ca8210_rx_done() only checks the received packet length
len = buf[1] + 2 against CA8210_SPI_BUF_SIZE (256). When buf[0] & SPI_SYN
is set and priv->sync_command_response is non-NULL, memcpy() copies up to
256 bytes into priv->sync_command_response, which points to a
struct mac_message object on the synchronous caller's stack, overflowing
the stack buffer:
BUG: KASAN: stack-out-of-bounds in ca8210_rx_done+0x117/0x6c0
Write of size 256 at addr ffff8881009e7c40 by task swapper/0/1
Call Trace:
<TASK>
dump_stack_lvl+0x70/0xa0
print_report+0x153/0x4c6
kasan_report+0xf1/0x120
kasan_check_range+0x125/0x200
__asan_memcpy+0x3c/0x60
ca8210_rx_done+0x117/0x6c0
...
This frame has 1 object:
[32, 182) 'response'
Check len > sizeof(struct mac_message) instead of
len > CA8210_SPI_BUF_SIZE in ca8210_rx_done() so that any packet exceeding
sizeof(struct mac_message) is logged as erroneously long via dev_crit()
and dropped before copying into priv->sync_command_response or passing it
to ca8210_net_rx().
Tested in QEMU with KASAN enabled by passing a 256-byte SPI_SYN response
into ca8210_rx_done().
Fixes: ded845a781a5 ("ieee802154: Add CA8210 IEEE 802.15.4 device driver")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
---
Changes in v3:
- Check len > sizeof(struct mac_message) at the top of ca8210_rx_done()
where dev_crit() logs the error and drops the packet instead of silently
truncating memcpy() with min_t(), addressing David Laight's feedback.
Changes in v2:
- Split the ca8210 fixes into three single-issue patches (1/3..3/3).
drivers/net/ieee802154/ca8210.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ieee802154/ca8210.c b/drivers/net/ieee802154/ca8210.c
index 01af4f9..a990a0f 100644
--- a/drivers/net/ieee802154/ca8210.c
+++ b/drivers/net/ieee802154/ca8210.c
@@ -686,7 +686,7 @@ static void ca8210_rx_done(struct cas_control *cas_ctl)
buf = cas_ctl->tx_in_buf;
len = buf[1] + 2;
- if (len > CA8210_SPI_BUF_SIZE) {
+ if (len > sizeof(struct mac_message)) {
dev_crit(
&priv->spi->dev,
"Received packet len (%u) erroneously long\n",
--
2.49.0
^ permalink raw reply [flat|nested] 5+ messages in thread* [PATCH net v3 2/3] ieee802154: ca8210: prevent stack buffer overflow in hwme_get_request_sync()
2026-09-22 9:30 [PATCH net v3 0/3] ieee802154: ca8210: fix stack and slab out-of-bounds accesses Hui Peng
2026-09-22 9:30 ` [PATCH net v3 1/3] ieee802154: ca8210: prevent stack buffer overflow in ca8210_rx_done() Hui Peng
@ 2026-09-22 9:30 ` Hui Peng
2026-09-22 9:47 ` David Laight
2026-09-22 9:30 ` [PATCH net v3 3/3] ieee802154: ca8210: validate data_ind length upfront in ca8210_skb_rx() Hui Peng
2 siblings, 1 reply; 5+ messages in thread
From: Hui Peng @ 2026-09-22 9:30 UTC (permalink / raw)
To: Harry Morris, Alexander Aring, Miquel Raynal, Stefan Schmidt
Cc: Hui Peng, David Laight, linux-wpan, netdev, linux-kernel, stable
In ca8210_get_ed(), an uninitialized u8 lenvar and a pointer to a 1-byte
stack buffer (u8 *level) are passed to hwme_get_request_sync(), which
unconditionally copies response.pdata.hwme_get_cnf.hw_attribute_length
bytes into hw_attribute_value without checking the caller's destination
buffer capacity, overflowing level on the stack when hw_attribute_length
exceeds 1:
BUG: KASAN: stack-out-of-bounds in hwme_get_request_sync.constprop.0.isra.0+0xf3/0x170
Write of size 16 at addr ffff888001907780 by task init/1
Call Trace:
<TASK>
dump_stack_lvl+0x70/0xa0
print_report+0x153/0x4c6
kasan_report+0xf1/0x120
kasan_check_range+0x125/0x200
__asan_memcpy+0x3c/0x60
hwme_get_request_sync.constprop.0.isra.0+0xf3/0x170
ca8210_get_ed+0x9c/0xf0
...
The buggy address belongs to stack of task init/1
and is located at offset 48 in frame:
ca8210_get_ed+0x0/0xf0
This frame has 2 objects:
[48, 49) 'level'
[64, 65) 'lenvar'
Initialize lenvar = 1 in ca8210_get_ed() and return
IEEE802154_SYSTEM_ERROR in hwme_get_request_sync() if
response.pdata.hwme_get_cnf.hw_attribute_length exceeds
*hw_attribute_length.
Tested in QEMU with KASAN enabled by passing an oversized
hw_attribute_length response into ca8210_get_ed().
Fixes: ded845a781a5 ("ieee802154: Add CA8210 IEEE 802.15.4 device driver")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
---
Changes in v3:
- No changes.
Changes in v2:
- Split out as patch 2/3.
- Replaced the temporary stack buffer in ca8210_get_ed() with lenvar = 1
and an upper-bound check against *hw_attribute_length in
hwme_get_request_sync() as requested by Miquel Raynal.
drivers/net/ieee802154/ca8210.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ieee802154/ca8210.c b/drivers/net/ieee802154/ca8210.c
index a990a0f..8aa7ffe 100644
--- a/drivers/net/ieee802154/ca8210.c
+++ b/drivers/net/ieee802154/ca8210.c
@@ -1677,6 +1677,9 @@ static u8 hwme_get_request_sync(
return IEEE802154_SYSTEM_ERROR;
if (response.pdata.hwme_get_cnf.status == IEEE802154_SUCCESS) {
+ if (response.pdata.hwme_get_cnf.hw_attribute_length >
+ *hw_attribute_length)
+ return IEEE802154_SYSTEM_ERROR;
*hw_attribute_length =
response.pdata.hwme_get_cnf.hw_attribute_length;
memcpy(
@@ -2027,7 +2030,7 @@ static int ca8210_xmit_async(struct ieee802154_hw *hw, struct sk_buff *skb)
*/
static int ca8210_get_ed(struct ieee802154_hw *hw, u8 *level)
{
- u8 lenvar;
+ u8 lenvar = 1;
struct ca8210_priv *priv = hw->priv;
return link_to_linux_err(
--
2.49.0
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH net v3 2/3] ieee802154: ca8210: prevent stack buffer overflow in hwme_get_request_sync()
2026-09-22 9:30 ` [PATCH net v3 2/3] ieee802154: ca8210: prevent stack buffer overflow in hwme_get_request_sync() Hui Peng
@ 2026-09-22 9:47 ` David Laight
0 siblings, 0 replies; 5+ messages in thread
From: David Laight @ 2026-09-22 9:47 UTC (permalink / raw)
To: Hui Peng
Cc: Harry Morris, Alexander Aring, Miquel Raynal, Stefan Schmidt,
linux-wpan, netdev, linux-kernel, stable
On Tue, 22 Sep 2026 09:30:24 +0000
Hui Peng <benquike@gmail.com> wrote:
> In ca8210_get_ed(), an uninitialized u8 lenvar and a pointer to a 1-byte
> stack buffer (u8 *level) are passed to hwme_get_request_sync(), which
> unconditionally copies response.pdata.hwme_get_cnf.hw_attribute_length
> bytes into hw_attribute_value without checking the caller's destination
> buffer capacity, overflowing level on the stack when hw_attribute_length
> exceeds 1:
>
> BUG: KASAN: stack-out-of-bounds in hwme_get_request_sync.constprop.0.isra.0+0xf3/0x170
> Write of size 16 at addr ffff888001907780 by task init/1
> Call Trace:
> <TASK>
> dump_stack_lvl+0x70/0xa0
> print_report+0x153/0x4c6
> kasan_report+0xf1/0x120
> kasan_check_range+0x125/0x200
> __asan_memcpy+0x3c/0x60
> hwme_get_request_sync.constprop.0.isra.0+0xf3/0x170
> ca8210_get_ed+0x9c/0xf0
> ...
> The buggy address belongs to stack of task init/1
> and is located at offset 48 in frame:
> ca8210_get_ed+0x0/0xf0
> This frame has 2 objects:
> [48, 49) 'level'
> [64, 65) 'lenvar'
>
> Initialize lenvar = 1 in ca8210_get_ed() and return
> IEEE802154_SYSTEM_ERROR in hwme_get_request_sync() if
> response.pdata.hwme_get_cnf.hw_attribute_length exceeds
> *hw_attribute_length.
This function is silly.
There is exactly one caller, the only valid length seems to 1 (is zero valid?),
not much point using memcpy() either.
David
>
> Tested in QEMU with KASAN enabled by passing an oversized
> hw_attribute_length response into ca8210_get_ed().
>
> Fixes: ded845a781a5 ("ieee802154: Add CA8210 IEEE 802.15.4 device driver")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Hui Peng <benquike@gmail.com>
> ---
> Changes in v3:
> - No changes.
>
> Changes in v2:
> - Split out as patch 2/3.
> - Replaced the temporary stack buffer in ca8210_get_ed() with lenvar = 1
> and an upper-bound check against *hw_attribute_length in
> hwme_get_request_sync() as requested by Miquel Raynal.
>
> drivers/net/ieee802154/ca8210.c | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/net/ieee802154/ca8210.c b/drivers/net/ieee802154/ca8210.c
> index a990a0f..8aa7ffe 100644
> --- a/drivers/net/ieee802154/ca8210.c
> +++ b/drivers/net/ieee802154/ca8210.c
> @@ -1677,6 +1677,9 @@ static u8 hwme_get_request_sync(
> return IEEE802154_SYSTEM_ERROR;
>
> if (response.pdata.hwme_get_cnf.status == IEEE802154_SUCCESS) {
> + if (response.pdata.hwme_get_cnf.hw_attribute_length >
> + *hw_attribute_length)
> + return IEEE802154_SYSTEM_ERROR;
> *hw_attribute_length =
> response.pdata.hwme_get_cnf.hw_attribute_length;
> memcpy(
> @@ -2027,7 +2030,7 @@ static int ca8210_xmit_async(struct ieee802154_hw *hw, struct sk_buff *skb)
> */
> static int ca8210_get_ed(struct ieee802154_hw *hw, u8 *level)
> {
> - u8 lenvar;
> + u8 lenvar = 1;
> struct ca8210_priv *priv = hw->priv;
>
> return link_to_linux_err(
^ permalink raw reply [flat|nested] 5+ messages in thread
* [PATCH net v3 3/3] ieee802154: ca8210: validate data_ind length upfront in ca8210_skb_rx()
2026-09-22 9:30 [PATCH net v3 0/3] ieee802154: ca8210: fix stack and slab out-of-bounds accesses Hui Peng
2026-09-22 9:30 ` [PATCH net v3 1/3] ieee802154: ca8210: prevent stack buffer overflow in ca8210_rx_done() Hui Peng
2026-09-22 9:30 ` [PATCH net v3 2/3] ieee802154: ca8210: prevent stack buffer overflow in hwme_get_request_sync() Hui Peng
@ 2026-09-22 9:30 ` Hui Peng
2 siblings, 0 replies; 5+ messages in thread
From: Hui Peng @ 2026-09-22 9:30 UTC (permalink / raw)
To: Harry Morris, Alexander Aring, Miquel Raynal, Stefan Schmidt
Cc: Hui Peng, David Laight, linux-wpan, netdev, linux-kernel, stable
In ca8210_skb_rx(), data_ind is read at offsets 22 (msdulen), 23
(mpdulinkquality), 29 + msdulen (hdr.sec.level), 30..39 + msdulen
(security header), and 29 .. 29 + msdulen (payload) without verifying
that the received SPI frame length len covers those offsets, causing an
out-of-bounds read when msdulen exceeds len - 30:
BUG: KASAN: slab-out-of-bounds in ca8210_skb_rx.constprop.0.isra.0+0x137/0x160
Read of size 64 at addr ffff888006453ddd by task init/1
Call Trace:
<TASK>
dump_stack_lvl+0x70/0xa0
print_report+0x153/0x4c6
kasan_report+0xf1/0x120
kasan_check_range+0x125/0x200
__asan_memcpy+0x23/0x60
ca8210_skb_rx.constprop.0.isra.0+0x137/0x160
ca8210_net_rx+0x96/0xc0
...
The buggy address belongs to the object at ffff888006453dc0
which belongs to the cache kmalloc-32 of size 32
The buggy address is located 29 bytes inside of
allocated 32-byte region [ffff888006453dc0, ffff888006453de0)
Consolidate all length and msdulen validations into a single upfront check
at the beginning of ca8210_skb_rx() before allocating the skb.
Tested in QEMU with KASAN enabled by passing a short data_ind buffer with
msdulen = 64 and len = 30 into ca8210_skb_rx().
Fixes: ded845a781a5 ("ieee802154: Add CA8210 IEEE 802.15.4 device driver")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
---
Changes in v3:
- No changes.
Changes in v2:
- Split out as patch 3/3.
- Consolidated all length checks in ca8210_skb_rx() into a single place
at the beginning of the function before dev_alloc_skb() and dropped the
unrelated hdr.seq assignment as requested by Miquel Raynal.
drivers/net/ieee802154/ca8210.c | 32 ++++++++++++++++++++++----------
1 file changed, 22 insertions(+), 10 deletions(-)
diff --git a/drivers/net/ieee802154/ca8210.c b/drivers/net/ieee802154/ca8210.c
index 8aa7ffe..ab245ad 100644
--- a/drivers/net/ieee802154/ca8210.c
+++ b/drivers/net/ieee802154/ca8210.c
@@ -1758,19 +1758,15 @@ static int ca8210_skb_rx(
u8 *data_ind
)
{
- struct ieee802154_hdr hdr;
+ struct ieee802154_hdr hdr = { };
int msdulen;
int hlen;
- u8 mpdulinkquality = data_ind[23];
+ u8 mpdulinkquality;
struct sk_buff *skb;
struct ca8210_priv *priv = hw->priv;
- /* Allocate mtu size buffer for every rx packet */
- skb = dev_alloc_skb(IEEE802154_MTU + sizeof(hdr));
- if (!skb)
- return -ENOMEM;
-
- skb_reserve(skb, sizeof(hdr));
+ if (len < 30)
+ return -EMSGSIZE;
msdulen = data_ind[22]; /* msdu_length */
if (msdulen > IEEE802154_MTU) {
@@ -1778,9 +1774,25 @@ static int ca8210_skb_rx(
&priv->spi->dev,
"received erroneously large msdu length!\n"
);
- kfree_skb(skb);
return -EMSGSIZE;
}
+
+ if (len < 30 + msdulen ||
+ (!priv->promiscuous && data_ind[29 + msdulen] > 0 &&
+ len < 29 + msdulen + sizeof(struct secspec))) {
+ dev_err(&priv->spi->dev,
+ "received truncated data indication!\n");
+ return -EMSGSIZE;
+ }
+
+ mpdulinkquality = data_ind[23];
+
+ /* Allocate mtu size buffer for every rx packet */
+ skb = dev_alloc_skb(IEEE802154_MTU + sizeof(hdr));
+ if (!skb)
+ return -ENOMEM;
+
+ skb_reserve(skb, sizeof(hdr));
dev_dbg(&priv->spi->dev, "skb buffer length = %d\n", msdulen);
if (priv->promiscuous)
--
2.49.0
^ permalink raw reply [flat|nested] 5+ messages in thread