This series fixes three out-of-bounds access bugs in the Cascoda CA8210
IEEE 802.15.4 driver:
1. Reject received SPI packets with len > sizeof(struct mac_message) in
ca8210_rx_done() instead of checking len > CA8210_SPI_BUF_SIZE (256),
preventing a stack buffer overflow when copying a synchronous response
into priv->sync_command_response (a struct mac_message on the caller's
stack) and matching the actual SPI transfer length
(cas_ctl->transfer.len = sizeof(struct mac_message)).
2. Initialize lenvar = 1 in ca8210_get_ed() and validate
hw_attribute_length against *hw_attribute_length in
hwme_get_request_sync() before memcpy() to prevent overflowing the
caller's stack buffer.
3. Validate the received SPI frame length len upfront at the start of
ca8210_skb_rx() before reading data_ind or allocating the skb.
Changes in v3:
- Patch 1/3: Check len > sizeof(struct mac_message) in ca8210_rx_done()
where dev_crit() logs "Received packet len (%u) erroneously long" and
drops the packet, instead of silently truncating the memcpy() with
min_t(), addressing David Laight's feedback.
Changes in v2:
- Split the ca8210 fixes into three single-issue patches (1/3..3/3) and
addressed Miquel Raynal's review comments on patches 2/3 and 3/3.
Hui Peng (3):
ieee802154: ca8210: prevent stack buffer overflow in ca8210_rx_done()
ieee802154: ca8210: prevent stack buffer overflow in
hwme_get_request_sync()
ieee802154: ca8210: validate data_ind length upfront in
ca8210_skb_rx()
drivers/net/ieee802154/ca8210.c | 39 +++++++++++++++++++++++----------
1 file changed, 27 insertions(+), 12 deletions(-)
--
2.49.0
