Re: [PATCH] mac802154: fix uninitialized security header fields

Hello,

On 14/12/2025 at 00:13:39 GMT, Kathara Sasikumar [off-list ref] wrote:

KMSAN reported an uninitialized-value access in
ieee802154_hdr_push_sechdr(). This happened because
mac802154_set_header_security() allowed frames with cb->secen=1 but
LLSEC disabled when secen_override=0, leaving parts of the security
header uninitialized.

Fix the validation so security-enabled frames are rejected whenever
LLSEC is disabled, regardless of secen_override. Also clear the full
header struct in the header creation functions to avoid partial
initialization.

Reported-by: syzbot+60a66d44892b66b56545@syzkaller.appspotmail.com
Tested-by: syzbot+60a66d44892b66b56545@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=60a66d44892b66b56545
Signed-off-by: Kathara Sasikumar <redacted>
---

For what I understand... :-)

Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>

Thanks,
Miquèl