Re: [PATCH net] mac802154: llsec: reject frames shorter than the authentication tag

[Breno Leitao <leitao@debian.org>]

On Thu, Jul 09, 2026 at 03:12:46PM +0200, Doruk Tan Ozturk wrote:

> Reported-by: Doruk Tan Ozturk <doruk@0sec.ai>
> Signed-off-by: Doruk Tan Ozturk <doruk@0sec.ai>

Usually you don't have Reported-by if you are fixing something yourself.

> ---
>  net/mac802154/llsec.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/net/mac802154/llsec.c b/net/mac802154/llsec.c
> index 5e7cc11fab3a..364a1ac1d771 100644
> --- a/net/mac802154/llsec.c
> +++ b/net/mac802154/llsec.c
> @@ -893,6 +893,11 @@ llsec_do_decrypt_auth(struct sk_buff *skb, const struct mac802154_llsec *sec,

Why not returning here, before sg_init_one()? here you alrady have
datalen and authlen.

>  	sg_init_one(&sg, skb_mac_header(skb), assoclen + datalen);
>  
> +	if (datalen < authlen) {
> +		kfree_sensitive(req);
> +		return -EBADMSG;
> +	}
> +
>  	if (!(hdr->sec.level & IEEE802154_SCF_SECLEVEL_ENC)) {
>  		assoclen += datalen - authlen;
>  		datalen = authlen;
> -- 
> 2.43.0
> 
>