In ca8210_spi_transfer(), each SPI transfer reads
sizeof(struct mac_message) bytes into cas_ctl->tx_in_buf:
cas_ctl->transfer.len = sizeof(struct mac_message);
However, ca8210_rx_done() only checks the received packet length
len = buf[1] + 2 against CA8210_SPI_BUF_SIZE (256). When buf[0] & SPI_SYN
is set and priv->sync_command_response is non-NULL, memcpy() copies up to
256 bytes into priv->sync_command_response, which points to a
struct mac_message object on the synchronous caller's stack, overflowing
the stack buffer:
BUG: KASAN: stack-out-of-bounds in ca8210_rx_done+0x117/0x6c0
Write of size 256 at addr ffff8881009e7c40 by task swapper/0/1
Call Trace:
<TASK>
dump_stack_lvl+0x70/0xa0
print_report+0x153/0x4c6
kasan_report+0xf1/0x120
kasan_check_range+0x125/0x200
__asan_memcpy+0x3c/0x60
ca8210_rx_done+0x117/0x6c0
...
This frame has 1 object:
[32, 182) 'response'
Check len > sizeof(struct mac_message) instead of
len > CA8210_SPI_BUF_SIZE in ca8210_rx_done() so that any packet exceeding
sizeof(struct mac_message) is logged as erroneously long via dev_crit()
and dropped before copying into priv->sync_command_response or passing it
to ca8210_net_rx().
Tested in QEMU with KASAN enabled by passing a 256-byte SPI_SYN response
into ca8210_rx_done().
Fixes: ded845a781a5 ("ieee802154: Add CA8210 IEEE 802.15.4 device driver")
Cc: [email protected]
Assisted-by: LLM
Signed-off-by: Hui Peng <[email protected]>
---
Changes in v3:
- Check len > sizeof(struct mac_message) at the top of ca8210_rx_done()
where dev_crit() logs the error and drops the packet instead of silently
truncating memcpy() with min_t(), addressing David Laight's feedback.
Changes in v2:
- Split the ca8210 fixes into three single-issue patches (1/3..3/3).
drivers/net/ieee802154/ca8210.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ieee802154/ca8210.c b/drivers/net/ieee802154/ca8210.c
index 01af4f9..a990a0f 100644
--- a/drivers/net/ieee802154/ca8210.c
+++ b/drivers/net/ieee802154/ca8210.c
@@ -686,7 +686,7 @@ static void ca8210_rx_done(struct cas_control *cas_ctl)
buf = cas_ctl->tx_in_buf;
len = buf[1] + 2;
- if (len > CA8210_SPI_BUF_SIZE) {
+ if (len > sizeof(struct mac_message)) {
dev_crit(
&priv->spi->dev,
"Received packet len (%u) erroneously long\n",
--
2.49.0
