From: Miquel Raynal <miquel.raynal@bootlin.com>
To: Fan Wu <fanwu01@zju.edu.cn>
Cc: linux-wpan@vger.kernel.org,
Stefan Schmidt <stefan@datenfreihafen.org>,
Alexander Aring <alex.aring@gmail.com>,
Varka Bhadram <varkab@cdac.in>,
Andrew Lunn <andrew+netdev@lunn.ch>,
"David S . Miller" <davem@davemloft.net>,
Eric Dumazet <edumazet@google.com>,
Jakub Kicinski <kuba@kernel.org>,
Paolo Abeni <pabeni@redhat.com>,
netdev@vger.kernel.org, linux-kernel@vger.kernel.org,
stable@vger.kernel.org
Subject: Re: [PATCH v3 1/2] ieee802154: cc2520: fix FIFOP work use-after-free
Date: Tue, 11 Aug 2026 10:00:45 +0200 [thread overview]
Message-ID: <87o6f9ozma.fsf@bootlin.com> (raw)
In-Reply-To: <20260811010359.131381-2-fanwu01@zju.edu.cn> (Fan Wu's message of "Tue, 11 Aug 2026 01:03:58 +0000")
> The FIFOP interrupt handler queues cc2520_fifop_irqwork. On removal,
> cc2520_remove() only flushes the work. The devm-managed FIFOP IRQ
> remains active until after ->remove() returns and can queue the work
> again after that flush, allowing it to run after the private data is
> released.
>
> Disable the work with disable_work_sync() instead of flushing it, so
> the handler can no longer queue it once removal begins. Destroy the
> buffer mutex last, since the worker and the stop callback invoked
> through ieee802154_unregister_hw() both take it.
>
> Found by an in-house static analysis tool.
>
> Fixes: 0da6bc8cc341 ("ieee802154: cc2520: adds driver for TI CC2520 radio")
> Cc: stable@vger.kernel.org # v6.10+
> Suggested-by: Miquel Raynal <miquel.raynal@bootlin.com>
> Assisted-by: Codex:gpt-5.6
> Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
next prev parent reply other threads:[~2026-08-11 8:01 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-11 1:03 [PATCH v3 0/2] cc2520: fix FIFOP work and RX tasklet use-after-free Fan Wu
2026-08-11 1:03 ` [PATCH v3 1/2] ieee802154: cc2520: fix FIFOP work use-after-free Fan Wu
2026-08-11 8:00 ` Miquel Raynal [this message]
2026-08-11 1:03 ` [PATCH v3 2/2] ieee802154: cc2520: fix RX tasklet use-after-free Fan Wu
2026-08-11 8:28 ` Miquel Raynal
2026-08-11 9:48 ` Fan Wu
2026-08-11 13:14 ` Miquel Raynal
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87o6f9ozma.fsf@bootlin.com \
--to=miquel.raynal@bootlin.com \
--cc=alex.aring@gmail.com \
--cc=andrew+netdev@lunn.ch \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=fanwu01@zju.edu.cn \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-wpan@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=stable@vger.kernel.org \
--cc=stefan@datenfreihafen.org \
--cc=varkab@cdac.in \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox