Re: [PATCH] ieee802154: cc2520, mcr20a: reject invalid RX frame lengths from SPI FIFO

[Miquel Raynal <miquel.raynal@bootlin.com>]

On 19/09/2026 at 22:34:37 GMT, Hui Peng <benquike@gmail.com> wrote:

> In drivers/net/ieee802154/cc2520.c and drivers/net/ieee802154/mcr20a.c,
> validate the RX frame length byte read from the radio FIFO before
> subtracting the 2-byte FCS or allocating/trimming the skb so len < 2
> cannot underflow.
>
> Fixes: 0da6bc8cc341 ("ieee802154: cc2520: adds driver for TI CC2520 radio")
> Assisted-by: LLM
> Signed-off-by: Hui Peng <benquike@gmail.com>
> ---
> diff --git a/drivers/net/ieee802154/cc2520.c b/drivers/net/ieee802154/cc2520.c
> index abfcfe07246a..d2c8484d8fea 100644
> --- a/drivers/net/ieee802154/cc2520.c
> +++ b/drivers/net/ieee802154/cc2520.c
> @@ -482,8 +482,14 @@ cc2520_tx(struct ieee802154_hw *hw, struct sk_buff *skb)
>  	 * values on RX. This means we need to manually add the CRC on TX.
>  	 */
>  	if (priv->promiscuous) {
> -		u16 crc = crc_ccitt(0, skb->data, skb->len);
> +		u16 crc;
>  
> +		if (skb_tailroom(skb) < 2 &&
> +		    pskb_expand_head(skb, 0, 2, GFP_KERNEL)) {
> +			rc = -ENOMEM;
> +			goto err_tx;
> +		}
> +		crc = crc_ccitt(0, skb->data, skb->len);
>  		put_unaligned_le16(crc, skb_put(skb, 2));
>  		pkt_len = skb->len;
>  	} else {
> @@ -1147,8 +1153,8 @@ static int cc2520_probe(struct spi_device *spi)
>  	return 0;
>  
>  err_hw_init:
> -	mutex_destroy(&priv->buffer_mutex);
>  	flush_work(&priv->fifop_irqwork);
> +	mutex_destroy(&priv->buffer_mutex);

What about this?

Thanks,
Miquèl