Re: [PATCH] ieee802154: ca8210: validate received command lengths

[Miquel Raynal <miquel.raynal@bootlin.com>]

On 19/10/2026 at 19:54:00 +08, Jiaxin Li <18135327133@163.com> wrote:

> ca8210_rx_done() computes len from buf[1] but only checks the upper
> bound against CA8210_SPI_BUF_SIZE.  The code then reads command bytes
> that are not guaranteed to be present: buf[3] for MCPS-DATA.confirm and
> buf[2] for the HWME wakeup indication.  ca8210_net_rx() similarly reads
> command[26] for MCPS-DATA.indication and command[3] for
> MCPS-DATA.confirm without a lower-bound check.
>
> Add the missing per-command length checks and drop or ignore short
> messages.
>
> Signed-off-by: Jiaxin Li <18135327133@163.com>

You are making totally arbitrary bound checks. Yes these checks may be
relevant, but please go beyond the very single array access that your LLM
saw and try to make sense out of what is done in the driver. Then
propose meaningful checks.

Thanks,
Miquèl