On Thu, Jul 09, 2026 at 03:12:46PM +0200, Doruk Tan Ozturk wrote:
> Reported-by: Doruk Tan Ozturk <[email protected]>
> Signed-off-by: Doruk Tan Ozturk <[email protected]>
Usually you don't have Reported-by if you are fixing something yourself.
> ---
> net/mac802154/llsec.c | 5 +++++
> 1 file changed, 5 insertions(+)
>
> diff --git a/net/mac802154/llsec.c b/net/mac802154/llsec.c
> index 5e7cc11fab3a..364a1ac1d771 100644
> --- a/net/mac802154/llsec.c
> +++ b/net/mac802154/llsec.c
> @@ -893,6 +893,11 @@ llsec_do_decrypt_auth(struct sk_buff *skb, const struct
> mac802154_llsec *sec,
Why not returning here, before sg_init_one()? here you alrady have
datalen and authlen.
> sg_init_one(&sg, skb_mac_header(skb), assoclen + datalen);
>
> + if (datalen < authlen) {
> + kfree_sensitive(req);
> + return -EBADMSG;
> + }
> +
> if (!(hdr->sec.level & IEEE802154_SCF_SECLEVEL_ENC)) {
> assoclen += datalen - authlen;
> datalen = authlen;
> --
> 2.43.0
>
>
