> Check len > sizeof(struct mac_message) instead of
> len > CA8210_SPI_BUF_SIZE in ca8210_rx_done() so that any packet exceeding
> sizeof(struct mac_message) is logged as erroneously long via dev_crit()
> and dropped before copying into priv->sync_command_response or passing it
> to ca8210_net_rx().
>
> Tested in QEMU with KASAN enabled by passing a 256-byte SPI_SYN response
> into ca8210_rx_done().
>
> Fixes: ded845a781a5 ("ieee802154: Add CA8210 IEEE 802.15.4 device driver")
> Cc: [email protected]
> Assisted-by: LLM
> Signed-off-by: Hui Peng <[email protected]>Reviewed-by: Miquel Raynal <[email protected]>
