In ca8210_rx_done(), the packet length len = buf[1] + 2 is only checked
against CA8210_SPI_BUF_SIZE (256). When buf[0] & SPI_SYN is set and
priv->sync_command_response is non-NULL, memcpy() copies up to 256 bytes
into priv->sync_command_response, which points to a struct mac_message
object (sizeof(struct mac_message) = 250 bytes) on the synchronous
caller's stack, overflowing the stack buffer by up to 6 bytes:
BUG: KASAN: stack-out-of-bounds in ca8210_rx_done+0xc4/0xe0
Write of size 256 at addr ffff888001907660 by task init/1
Call Trace:
<TASK>
dump_stack_lvl+0x70/0xa0
print_report+0x153/0x4c6
kasan_report+0xf1/0x120
kasan_check_range+0x125/0x200
__asan_memcpy+0x3c/0x60
ca8210_rx_done+0xc4/0xe0
ca8210_spi_exchange+0x12e/0x190
...
The buggy address belongs to stack of task init/1
and is located at offset 32 in frame:
ca8210_spi_exchange+0x0/0x190
This frame has 1 object:
[32, 282) 'response'
Bound the synchronous response memcpy() length to
min_t(size_t, len, sizeof(struct mac_message)).
Tested in QEMU with KASAN enabled by passing a 256-byte SPI_SYN response
into ca8210_rx_done().
Fixes: ded845a781a5 ("ieee802154: Add CA8210 IEEE 802.15.4 device driver")
Cc: [email protected]
Assisted-by: LLM
Signed-off-by: Hui Peng <[email protected]>
---
Changes in v2:
- Split the ca8210 fixes into three single-issue patches (1/3..3/3).
drivers/net/ieee802154/ca8210.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ieee802154/ca8210.c b/drivers/net/ieee802154/ca8210.c
index 01af4f9..c009930 100644
--- a/drivers/net/ieee802154/ca8210.c
+++ b/drivers/net/ieee802154/ca8210.c
@@ -697,7 +697,8 @@ static void ca8210_rx_done(struct cas_control *cas_ctl)
if (buf[0] & SPI_SYN) {
if (priv->sync_command_response) {
- memcpy(priv->sync_command_response, buf, len);
+ memcpy(priv->sync_command_response, buf,
+ min_t(size_t, len, sizeof(struct mac_message)));
complete(&priv->sync_exchange_complete);
} else {
if (cascoda_api_upstream)
--
2.47.3
