On Tue, 22 Sep 2026 09:30:24 +0000
Hui Peng <[email protected]> wrote:
> In ca8210_get_ed(), an uninitialized u8 lenvar and a pointer to a 1-byte
> stack buffer (u8 *level) are passed to hwme_get_request_sync(), which
> unconditionally copies response.pdata.hwme_get_cnf.hw_attribute_length
> bytes into hw_attribute_value without checking the caller's destination
> buffer capacity, overflowing level on the stack when hw_attribute_length
> exceeds 1:
>
> BUG: KASAN: stack-out-of-bounds in
> hwme_get_request_sync.constprop.0.isra.0+0xf3/0x170
> Write of size 16 at addr ffff888001907780 by task init/1
> Call Trace:
> <TASK>
> dump_stack_lvl+0x70/0xa0
> print_report+0x153/0x4c6
> kasan_report+0xf1/0x120
> kasan_check_range+0x125/0x200
> __asan_memcpy+0x3c/0x60
> hwme_get_request_sync.constprop.0.isra.0+0xf3/0x170
> ca8210_get_ed+0x9c/0xf0
> ...
> The buggy address belongs to stack of task init/1
> and is located at offset 48 in frame:
> ca8210_get_ed+0x0/0xf0
> This frame has 2 objects:
> [48, 49) 'level'
> [64, 65) 'lenvar'
>
> Initialize lenvar = 1 in ca8210_get_ed() and return
> IEEE802154_SYSTEM_ERROR in hwme_get_request_sync() if
> response.pdata.hwme_get_cnf.hw_attribute_length exceeds
> *hw_attribute_length.
This function is silly.
There is exactly one caller, the only valid length seems to 1 (is zero valid?),
not much point using memcpy() either.
David
>
> Tested in QEMU with KASAN enabled by passing an oversized
> hw_attribute_length response into ca8210_get_ed().
>
> Fixes: ded845a781a5 ("ieee802154: Add CA8210 IEEE 802.15.4 device driver")
> Cc: [email protected]
> Assisted-by: LLM
> Signed-off-by: Hui Peng <[email protected]>
> ---
> Changes in v3:
> - No changes.
>
> Changes in v2:
> - Split out as patch 2/3.
> - Replaced the temporary stack buffer in ca8210_get_ed() with lenvar = 1
> and an upper-bound check against *hw_attribute_length in
> hwme_get_request_sync() as requested by Miquel Raynal.
>
> drivers/net/ieee802154/ca8210.c | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/net/ieee802154/ca8210.c b/drivers/net/ieee802154/ca8210.c
> index a990a0f..8aa7ffe 100644
> --- a/drivers/net/ieee802154/ca8210.c
> +++ b/drivers/net/ieee802154/ca8210.c
> @@ -1677,6 +1677,9 @@ static u8 hwme_get_request_sync(
> return IEEE802154_SYSTEM_ERROR;
>
> if (response.pdata.hwme_get_cnf.status == IEEE802154_SUCCESS) {
> + if (response.pdata.hwme_get_cnf.hw_attribute_length >
> + *hw_attribute_length)
> + return IEEE802154_SYSTEM_ERROR;
> *hw_attribute_length =
> response.pdata.hwme_get_cnf.hw_attribute_length;
> memcpy(
> @@ -2027,7 +2030,7 @@ static int ca8210_xmit_async(struct ieee802154_hw *hw,
> struct sk_buff *skb)
> */
> static int ca8210_get_ed(struct ieee802154_hw *hw, u8 *level)
> {
> - u8 lenvar;
> + u8 lenvar = 1;
> struct ca8210_priv *priv = hw->priv;
>
> return link_to_linux_err(
