On Mon, 21 Sep 2026 07:42:03 +0000
Hui Peng <[email protected]> wrote:
> In ca8210_rx_done(), the packet length len = buf[1] + 2 is only checked
> against CA8210_SPI_BUF_SIZE (256). When buf[0] & SPI_SYN is set and
> priv->sync_command_response is non-NULL, memcpy() copies up to 256 bytes
> into priv->sync_command_response, which points to a struct mac_message
> object (sizeof(struct mac_message) = 250 bytes) on the synchronous
> caller's stack, overflowing the stack buffer by up to 6 bytes:
>
> BUG: KASAN: stack-out-of-bounds in ca8210_rx_done+0xc4/0xe0
> Write of size 256 at addr ffff888001907660 by task init/1
> Call Trace:
> <TASK>
> dump_stack_lvl+0x70/0xa0
> print_report+0x153/0x4c6
> kasan_report+0xf1/0x120
> kasan_check_range+0x125/0x200
> __asan_memcpy+0x3c/0x60
> ca8210_rx_done+0xc4/0xe0
> ca8210_spi_exchange+0x12e/0x190
> ...
> The buggy address belongs to stack of task init/1
> and is located at offset 32 in frame:
> ca8210_spi_exchange+0x0/0x190
> This frame has 1 object:
> [32, 282) 'response'
>
> Bound the synchronous response memcpy() length to
> min_t(size_t, len, sizeof(struct mac_message)).
Why min_t() ?
len is unsigned so min() is fine.
Shouldn't there also be some kind of indication the data was truncated?
David
>
> Tested in QEMU with KASAN enabled by passing a 256-byte SPI_SYN response
> into ca8210_rx_done().
>
> Fixes: ded845a781a5 ("ieee802154: Add CA8210 IEEE 802.15.4 device driver")
> Cc: [email protected]
> Assisted-by: LLM
> Signed-off-by: Hui Peng <[email protected]>
> ---
> Changes in v2:
> - Split the ca8210 fixes into three single-issue patches (1/3..3/3).
>
> drivers/net/ieee802154/ca8210.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/net/ieee802154/ca8210.c b/drivers/net/ieee802154/ca8210.c
> index 01af4f9..c009930 100644
> --- a/drivers/net/ieee802154/ca8210.c
> +++ b/drivers/net/ieee802154/ca8210.c
> @@ -697,7 +697,8 @@ static void ca8210_rx_done(struct cas_control *cas_ctl)
>
> if (buf[0] & SPI_SYN) {
> if (priv->sync_command_response) {
> - memcpy(priv->sync_command_response, buf, len);
> + memcpy(priv->sync_command_response, buf,
> + min_t(size_t, len, sizeof(struct mac_message)));
> complete(&priv->sync_exchange_complete);
> } else {
> if (cascoda_api_upstream)
