[PATCH] ieee802154: ca8210: validate received command lengths

[PATCH] ieee802154: ca8210: validate received command lengths

[Jiaxin Li]

ca8210_rx_done() computes len from buf[1] but only checks the upper
bound against CA8210_SPI_BUF_SIZE.  The code then reads command bytes
that are not guaranteed to be present: buf[3] for MCPS-DATA.confirm and
buf[2] for the HWME wakeup indication.  ca8210_net_rx() similarly reads
command[26] for MCPS-DATA.indication and command[3] for
MCPS-DATA.confirm without a lower-bound check.

Add the missing per-command length checks and drop or ignore short
messages.

Signed-off-by: Jiaxin Li <18135327133@163.com>
---
 drivers/net/ieee802154/ca8210.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ieee802154/ca8210.c b/drivers/net/ieee802154/ca8210.c
index 01af4f9cf..b6f9affee 100644
--- a/drivers/net/ieee802154/ca8210.c
+++ b/drivers/net/ieee802154/ca8210.c
@@ -710,7 +710,7 @@ static void ca8210_rx_done(struct cas_control *cas_ctl)
 	}
 
 	ca8210_net_rx(priv->hw, buf, len);
-	if (buf[0] == SPI_MCPS_DATA_CONFIRM) {
+	if (buf[0] == SPI_MCPS_DATA_CONFIRM && len >= 4) {
 		if (buf[3] == IEEE802154_TRANSACTION_OVERFLOW) {
 			dev_info(
 				&priv->spi->dev,
@@ -730,7 +730,7 @@ static void ca8210_rx_done(struct cas_control *cas_ctl)
 			mlme_reset_wpc->priv = priv;
 			queue_work(priv->mlme_workqueue, &mlme_reset_wpc->work);
 		}
-	} else if (buf[0] == SPI_HWME_WAKEUP_INDICATION) {
+	} else if (buf[0] == SPI_HWME_WAKEUP_INDICATION && len >= 3) {
 		dev_notice(
 			&priv->spi->dev,
 			"Wakeup indication received, reason:\n"
@@ -1859,6 +1859,10 @@ static int ca8210_net_rx(struct ieee802154_hw *hw, u8 *command, size_t len)
 
 	if (command[0] == SPI_MCPS_DATA_INDICATION) {
 		/* Received data */
+		if (len < 27) {
+			dev_warn(&priv->spi->dev, "short MCPS-DATA.indication\n");
+			return -EINVAL;
+		}
 		spin_lock_irqsave(&priv->lock, flags);
 		if (command[26] == priv->last_dsn) {
 			dev_dbg(
@@ -1873,6 +1877,10 @@ static int ca8210_net_rx(struct ieee802154_hw *hw, u8 *command, size_t len)
 		spin_unlock_irqrestore(&priv->lock, flags);
 		return ca8210_skb_rx(hw, len - 2, command + 2);
 	} else if (command[0] == SPI_MCPS_DATA_CONFIRM) {
+		if (len < 4) {
+			dev_warn(&priv->spi->dev, "short MCPS-DATA.confirm\n");
+			return -EINVAL;
+		}
 		status = command[3];
 		if (priv->async_tx_pending) {
 			return ca8210_async_xmit_complete(

-- 
2.34.1

Re: [PATCH] ieee802154: ca8210: validate received command lengths

[Miquel Raynal]

On 19/10/2026 at 19:54:00 +08, Jiaxin Li <18135327133@163.com> wrote:

> ca8210_rx_done() computes len from buf[1] but only checks the upper
> bound against CA8210_SPI_BUF_SIZE.  The code then reads command bytes
> that are not guaranteed to be present: buf[3] for MCPS-DATA.confirm and
> buf[2] for the HWME wakeup indication.  ca8210_net_rx() similarly reads
> command[26] for MCPS-DATA.indication and command[3] for
> MCPS-DATA.confirm without a lower-bound check.
>
> Add the missing per-command length checks and drop or ignore short
> messages.
>
> Signed-off-by: Jiaxin Li <18135327133@163.com>

You are making totally arbitrary bound checks. Yes these checks may be
relevant, but please go beyond the very single array access that your LLM
saw and try to make sense out of what is done in the driver. Then
propose meaningful checks.

Thanks,
Miquèl

Re: [PATCH] ieee802154: ca8210: validate received command lengths

[Jiaxin Li]

Hi Miquèl,

Thank you for the review. You are right: those per-command checks were
ad hoc and did not follow the message framing.

I see that Hui Peng's series ("ieee802154: ca8210: fix stack and slab
out-of-bounds accesses") already covers ca8210_rx_done(),
hwme_get_request_sync(), and ca8210_skb_rx() with message-level length
validation. Please drop my patch; that series is the proper fix.

Thanks,
Jiaxin Li