CVE-2026-72047: ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit

In the Linux kernel, the following vulnerability has been resolved:

ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit

ca8210testintdriverwrite() and ca8210testintuserread() exchange a kmalloc'd buffer pointer through a struct kfifo, but pass a literal '4' as the byte count to kfifoin()/kfifoout().

This is correct on 32-bit (pointer = 4 bytes), but on 64-bit only the low 4 bytes of the 8-byte pointer are written into the FIFO. The reader then reads back 4 bytes into an 8-byte local pointer variable, leaving the upper 4 bytes uninitialized stack data. The first dereference of the reconstructed pointer (fifobuffer[1]) accesses an arbitrary kernel address and generally results in an oops.

Use sizeof(fifobuffer) so the byte count matches pointer width on every architecture.

The driver has no architecture restriction in Kconfig, so any 64-bit build with CONFIGIEEE802154CA8210DEBUGFS=y is exposed. Issue has been latent since the driver was added in 2017 because it is most commonly deployed on 32-bit MCUs.

Found via a custom Coccinelle semantic patch hunting for short-byte kfifo I/O on byte-mode kfifos used to shuttle pointers.