[PATCH net v2 0/2] mac802154: fix queued RX descriptor lifetime

[PATCH net v2 0/2] mac802154: fix queued RX descriptor lifetime

[Xuanqiang Luo]

From: Xuanqiang Luo <luoxuanqiang@kylinos.cn>

mac802154 queues one descriptor per received beacon or MAC command, but
each worker invocation dequeues only one. Since queue_work() coalesces
attempts to queue the same pending work item, a burst can add more
descriptors than scheduled invocations. A later frame may schedule another
invocation, but also adds a descriptor, so it does not necessarily reduce
the backlog. Descriptors can therefore remain queued indefinitely once
reception stops. The RX path, workers, and scan cleanup also access the
descriptor lists without common synchronization.

A queued descriptor carries its receiving interface beyond the RCU
read-side critical section without holding a netdev reference. If the
interface is removed first, the worker can dereference freed memory.

Protect the descriptor lists with a spinlock and keep the workers running
until the queues are empty. Then hold the netdev for the lifetime of each
queued descriptor to prevent it from being freed too early.

This ordering is required. Without the queue-draining fix, a descriptor
stranded by queue_work() coalescing would also strand its netdev reference,
as netdev_put() runs only when the descriptor is released, leaving the
netdev pinned indefinitely.

---
Changes:
v2:
  Patch 1 (new):
  - Serialize descriptor list access and requeue each worker while another
    descriptor remains.
  - Detach queued beacons under the same lock before scan cleanup frees
    them.

  Patch 2:
  - Replace the v1 drain_workqueue() approach, which does not cover work
    queued after the drain or the DEL_INTERFACE path, with a netdev
    reference held by each queued descriptor. (Sashiko.)

v1: https://lore.kernel.org/all/20260828101905.26865-1-xuanqiang.luo@linux.dev/

Xuanqiang Luo (2):
  mac802154: serialize and drain queued RX descriptors
  mac802154: pin netdevs for queued RX descriptors

 include/net/cfg802154.h      |  2 ++
 net/mac802154/ieee802154_i.h |  2 ++
 net/mac802154/main.c         |  1 +
 net/mac802154/rx.c           | 36 ++++++++++++++++++++++++++++++------
 net/mac802154/scan.c         |  8 +++++++-
 5 files changed, 42 insertions(+), 7 deletions(-)


base-commit: dc4b95b8fee95113587e93ca116356032d271371
-- 
2.43.0

[PATCH net v2 1/2] mac802154: serialize and drain queued RX descriptors

[Xuanqiang Luo]

From: Xuanqiang Luo <luoxuanqiang@kylinos.cn>

queue_work() coalesces attempts to queue an already pending work item.
The RX workers, however, consume only one descriptor per invocation. A
burst can therefore leave later descriptors queued until another frame
arrives, while the final descriptor may remain queued indefinitely.

The RX tasklet, workers, and scan cleanup also access the descriptor
lists without synchronization.

Protect both lists with a spinlock. Publish each descriptor and queue its
work while holding the lock. Remove each descriptor from the list before
processing it and, if another descriptor remains, queue the work again so
it runs after the current invocation.

Fixes: 57588c71177f ("mac802154: Handle passive scanning")
Fixes: d021d218f6d9 ("mac802154: Handle received BEACON_REQ")
Cc: stable@vger.kernel.org
Signed-off-by: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
---
 net/mac802154/ieee802154_i.h |  2 ++
 net/mac802154/main.c         |  1 +
 net/mac802154/rx.c           | 32 ++++++++++++++++++++++++++------
 net/mac802154/scan.c         |  7 ++++++-
 4 files changed, 35 insertions(+), 7 deletions(-)

diff --git a/net/mac802154/ieee802154_i.h b/net/mac802154/ieee802154_i.h
index 8f2bff268392b..096e6f0340dc7 100644
--- a/net/mac802154/ieee802154_i.h
+++ b/net/mac802154/ieee802154_i.h
@@ -74,6 +74,8 @@ struct ieee802154_local {
 	struct work_struct rx_beacon_work;
 	struct list_head rx_mac_cmd_list;
 	struct work_struct rx_mac_cmd_work;
+	/* Protects rx_beacon_list and rx_mac_cmd_list. */
+	spinlock_t rx_lists_lock;
 
 	/* Association */
 	struct ieee802154_pan_device *assoc_dev;
diff --git a/net/mac802154/main.c b/net/mac802154/main.c
index ea1efef3572ae..a6a976b0dea56 100644
--- a/net/mac802154/main.c
+++ b/net/mac802154/main.c
@@ -91,6 +91,7 @@ ieee802154_alloc_hw(size_t priv_data_len, const struct ieee802154_ops *ops)
 	INIT_LIST_HEAD(&local->interfaces);
 	INIT_LIST_HEAD(&local->rx_beacon_list);
 	INIT_LIST_HEAD(&local->rx_mac_cmd_list);
+	spin_lock_init(&local->rx_lists_lock);
 	mutex_init(&local->iflist_mtx);
 
 	tasklet_setup(&local->tasklet, ieee802154_tasklet_handler);
diff --git a/net/mac802154/rx.c b/net/mac802154/rx.c
index cd8f2a11920d0..26da20ea470ef 100644
--- a/net/mac802154/rx.c
+++ b/net/mac802154/rx.c
@@ -29,20 +29,38 @@ static int ieee802154_deliver_skb(struct sk_buff *skb)
 	return netif_receive_skb(skb);
 }
 
+static struct cfg802154_mac_pkt *
+mac802154_rx_dequeue(struct ieee802154_local *local,
+		     struct list_head *rx_list,
+		     struct work_struct *work)
+{
+	struct cfg802154_mac_pkt *mac_pkt;
+
+	spin_lock_bh(&local->rx_lists_lock);
+	mac_pkt = list_first_entry_or_null(rx_list,
+					   struct cfg802154_mac_pkt, node);
+	if (mac_pkt) {
+		list_del(&mac_pkt->node);
+		if (!list_empty(rx_list))
+			queue_work(local->mac_wq, work);
+	}
+	spin_unlock_bh(&local->rx_lists_lock);
+
+	return mac_pkt;
+}
+
 void mac802154_rx_beacon_worker(struct work_struct *work)
 {
 	struct ieee802154_local *local =
 		container_of(work, struct ieee802154_local, rx_beacon_work);
 	struct cfg802154_mac_pkt *mac_pkt;
 
-	mac_pkt = list_first_entry_or_null(&local->rx_beacon_list,
-					   struct cfg802154_mac_pkt, node);
+	mac_pkt = mac802154_rx_dequeue(local, &local->rx_beacon_list, work);
 	if (!mac_pkt)
 		return;
 
 	mac802154_process_beacon(local, mac_pkt->skb, mac_pkt->page, mac_pkt->channel);
 
-	list_del(&mac_pkt->node);
 	kfree_skb(mac_pkt->skb);
 	kfree(mac_pkt);
 }
@@ -76,8 +94,7 @@ void mac802154_rx_mac_cmd_worker(struct work_struct *work)
 	u8 mac_cmd;
 	int rc;
 
-	mac_pkt = list_first_entry_or_null(&local->rx_mac_cmd_list,
-					   struct cfg802154_mac_pkt, node);
+	mac_pkt = mac802154_rx_dequeue(local, &local->rx_mac_cmd_list, work);
 	if (!mac_pkt)
 		return;
 
@@ -123,7 +140,6 @@ void mac802154_rx_mac_cmd_worker(struct work_struct *work)
 	}
 
 out:
-	list_del(&mac_pkt->node);
 	kfree_skb(mac_pkt->skb);
 	kfree(mac_pkt);
 }
@@ -221,8 +237,10 @@ ieee802154_subif_frame(struct ieee802154_sub_if_data *sdata,
 		mac_pkt->sdata = sdata;
 		mac_pkt->page = sdata->local->scan_page;
 		mac_pkt->channel = sdata->local->scan_channel;
+		spin_lock_bh(&sdata->local->rx_lists_lock);
 		list_add_tail(&mac_pkt->node, &sdata->local->rx_beacon_list);
 		queue_work(sdata->local->mac_wq, &sdata->local->rx_beacon_work);
+		spin_unlock_bh(&sdata->local->rx_lists_lock);
 		return NET_RX_SUCCESS;
 
 	case IEEE802154_FC_TYPE_MAC_CMD:
@@ -233,8 +251,10 @@ ieee802154_subif_frame(struct ieee802154_sub_if_data *sdata,
 
 		mac_pkt->skb = skb_get(skb);
 		mac_pkt->sdata = sdata;
+		spin_lock_bh(&sdata->local->rx_lists_lock);
 		list_add_tail(&mac_pkt->node, &sdata->local->rx_mac_cmd_list);
 		queue_work(sdata->local->mac_wq, &sdata->local->rx_mac_cmd_work);
+		spin_unlock_bh(&sdata->local->rx_lists_lock);
 		return NET_RX_SUCCESS;
 
 	case IEEE802154_FC_TYPE_ACK:
diff --git a/net/mac802154/scan.c b/net/mac802154/scan.c
index 005338f89b75e..5fa98e001a8fb 100644
--- a/net/mac802154/scan.c
+++ b/net/mac802154/scan.c
@@ -105,8 +105,13 @@ static unsigned int mac802154_scan_get_channel_time(u8 duration_order,
 static void mac802154_flush_queued_beacons(struct ieee802154_local *local)
 {
 	struct cfg802154_mac_pkt *mac_pkt, *tmp;
+	LIST_HEAD(mac_pkt_list);
 
-	list_for_each_entry_safe(mac_pkt, tmp, &local->rx_beacon_list, node) {
+	spin_lock_bh(&local->rx_lists_lock);
+	list_splice_init(&local->rx_beacon_list, &mac_pkt_list);
+	spin_unlock_bh(&local->rx_lists_lock);
+
+	list_for_each_entry_safe(mac_pkt, tmp, &mac_pkt_list, node) {
 		list_del(&mac_pkt->node);
 		kfree_skb(mac_pkt->skb);
 		kfree(mac_pkt);
-- 
2.43.0

[PATCH net v2 2/2] mac802154: pin netdevs for queued RX descriptors

[Xuanqiang Luo]

From: Xuanqiang Luo <luoxuanqiang@kylinos.cn>

The RX path keeps the receiving sub-interface in queued beacon and MAC
command descriptors after leaving its RCU read-side critical section. An
interface can therefore be unregistered and freed before mac_wq consumes
the descriptor, leading to a use-after-free such as:

  BUG: KASAN: slab-use-after-free in mac802154_rx_mac_cmd_worker+0xc0/0x498 [mac802154]
  Read of size 8 at addr ffff0000c6db0ba8 by task kworker/u16:3/61
  ...
  Call trace:
   show_stack+0x20/0x38 (C)
   dump_stack_lvl+0x78/0x90
   print_address_description.constprop.0+0x88/0x398
   print_report+0xa8/0x278
   kasan_report+0xa8/0xf8
   __asan_load8+0x9c/0xc0
   mac802154_rx_mac_cmd_worker+0xc0/0x498 [mac802154]
   process_one_work+0x334/0x8b8
  ...
  Allocated by task 630:
   kasan_save_stack+0x2c/0x58
   kasan_save_track+0x20/0x40
   kasan_save_alloc_info+0x40/0x58
   __kasan_kmalloc+0xa0/0xb8
   __kvmalloc_node_noprof+0x1e8/0x588
   alloc_netdev_mqs+0x74/0x7f0
   ieee802154_if_add+0xac/0x630 [mac802154]
   ieee802154_register_hw+0x31c/0x3d0 [mac802154]
   fakelb_add_one+0x250/0x318 [fakelb]
  ...
  Freed by task 652:
   kasan_save_stack+0x2c/0x58
   kasan_save_track+0x20/0x40
   kasan_save_free_info+0x4c/0x78
   __kasan_slab_free+0x60/0x90
   kfree+0x194/0x478
   kvfree+0x44/0x60
   netdev_release+0x4c/0x68
   device_release+0xac/0x130
   kobject_cleanup+0x84/0x248
   kobject_put+0x98/0xf8
   netdev_run_todo+0x3a0/0x5e0
   rtnl_unlock+0x18/0x30
   ieee802154_unregister_hw+0x48/0x90 [mac802154]
   fakelb_remove+0xe8/0x148 [fakelb]

Hold the receiving netdev from before a descriptor is queued until the
descriptor is released. Since sdata is the netdev's private data, this also
keeps sdata valid while a worker or scan cleanup accesses the descriptor.

Fixes: 57588c71177f ("mac802154: Handle passive scanning")
Fixes: d021d218f6d9 ("mac802154: Handle received BEACON_REQ")
Cc: stable@vger.kernel.org
Signed-off-by: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
---
 include/net/cfg802154.h | 2 ++
 net/mac802154/rx.c      | 4 ++++
 net/mac802154/scan.c    | 1 +
 3 files changed, 7 insertions(+)

diff --git a/include/net/cfg802154.h b/include/net/cfg802154.h
index 76d2cd2e2b309..57343762d7f0b 100644
--- a/include/net/cfg802154.h
+++ b/include/net/cfg802154.h
@@ -369,6 +369,7 @@ struct cfg802154_beacon_request {
  * @node: MAC packets to process list member
  * @skb: the received sk_buff
  * @sdata: the interface on which @skb was received
+ * @dev_tracker: netdev reference held until the descriptor is released
  * @page: page configuration when @skb was received
  * @channel: channel configuration when @skb was received
  */
@@ -376,6 +377,7 @@ struct cfg802154_mac_pkt {
 	struct list_head node;
 	struct sk_buff *skb;
 	struct ieee802154_sub_if_data *sdata;
+	netdevice_tracker dev_tracker;
 	u8 page;
 	u8 channel;
 };
diff --git a/net/mac802154/rx.c b/net/mac802154/rx.c
index 26da20ea470ef..df2f6128ddd4a 100644
--- a/net/mac802154/rx.c
+++ b/net/mac802154/rx.c
@@ -62,6 +62,7 @@ void mac802154_rx_beacon_worker(struct work_struct *work)
 	mac802154_process_beacon(local, mac_pkt->skb, mac_pkt->page, mac_pkt->channel);
 
 	kfree_skb(mac_pkt->skb);
+	netdev_put(mac_pkt->sdata->dev, &mac_pkt->dev_tracker);
 	kfree(mac_pkt);
 }
 
@@ -141,6 +142,7 @@ void mac802154_rx_mac_cmd_worker(struct work_struct *work)
 
 out:
 	kfree_skb(mac_pkt->skb);
+	netdev_put(mac_pkt->sdata->dev, &mac_pkt->dev_tracker);
 	kfree(mac_pkt);
 }
 
@@ -237,6 +239,7 @@ ieee802154_subif_frame(struct ieee802154_sub_if_data *sdata,
 		mac_pkt->sdata = sdata;
 		mac_pkt->page = sdata->local->scan_page;
 		mac_pkt->channel = sdata->local->scan_channel;
+		netdev_hold(sdata->dev, &mac_pkt->dev_tracker, GFP_ATOMIC);
 		spin_lock_bh(&sdata->local->rx_lists_lock);
 		list_add_tail(&mac_pkt->node, &sdata->local->rx_beacon_list);
 		queue_work(sdata->local->mac_wq, &sdata->local->rx_beacon_work);
@@ -251,6 +254,7 @@ ieee802154_subif_frame(struct ieee802154_sub_if_data *sdata,
 
 		mac_pkt->skb = skb_get(skb);
 		mac_pkt->sdata = sdata;
+		netdev_hold(sdata->dev, &mac_pkt->dev_tracker, GFP_ATOMIC);
 		spin_lock_bh(&sdata->local->rx_lists_lock);
 		list_add_tail(&mac_pkt->node, &sdata->local->rx_mac_cmd_list);
 		queue_work(sdata->local->mac_wq, &sdata->local->rx_mac_cmd_work);
diff --git a/net/mac802154/scan.c b/net/mac802154/scan.c
index 5fa98e001a8fb..c3c61ebde1568 100644
--- a/net/mac802154/scan.c
+++ b/net/mac802154/scan.c
@@ -114,6 +114,7 @@ static void mac802154_flush_queued_beacons(struct ieee802154_local *local)
 	list_for_each_entry_safe(mac_pkt, tmp, &mac_pkt_list, node) {
 		list_del(&mac_pkt->node);
 		kfree_skb(mac_pkt->skb);
+		netdev_put(mac_pkt->sdata->dev, &mac_pkt->dev_tracker);
 		kfree(mac_pkt);
 	}
 }
-- 
2.43.0

Re: [PATCH net v2 1/2] mac802154: serialize and drain queued RX descriptors

[Miquel Raynal]

On 03/09/2026 at 20:32:01 +08, Xuanqiang Luo <xuanqiang.luo@linux.dev> wrote:

> From: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
>
> queue_work() coalesces attempts to queue an already pending work item.
> The RX workers, however, consume only one descriptor per invocation. A
> burst can therefore leave later descriptors queued until another frame
> arrives, while the final descriptor may remain queued indefinitely.
>
> The RX tasklet, workers, and scan cleanup also access the descriptor
> lists without synchronization.
>
> Protect both lists with a spinlock. Publish each descriptor and queue its
> work while holding the lock. Remove each descriptor from the list before
> processing it and, if another descriptor remains, queue the work again so
> it runs after the current invocation.
>
> Fixes: 57588c71177f ("mac802154: Handle passive scanning")
> Fixes: d021d218f6d9 ("mac802154: Handle received BEACON_REQ")
> Cc: stable@vger.kernel.org
> Signed-off-by: Xuanqiang Luo <luoxuanqiang@kylinos.cn>

Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>

Re: [PATCH net v2 2/2] mac802154: pin netdevs for queued RX descriptors

[Miquel Raynal]

On 03/09/2026 at 20:32:02 +08, Xuanqiang Luo <xuanqiang.luo@linux.dev> wrote:

> From: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
>
> The RX path keeps the receiving sub-interface in queued beacon and MAC
> command descriptors after leaving its RCU read-side critical section. An
> interface can therefore be unregistered and freed before mac_wq consumes
> the descriptor, leading to a use-after-free such as:
>
>   BUG: KASAN: slab-use-after-free in mac802154_rx_mac_cmd_worker+0xc0/0x498 [mac802154]
>   Read of size 8 at addr ffff0000c6db0ba8 by task kworker/u16:3/61
>   ...
>   Call trace:
>    show_stack+0x20/0x38 (C)
>    dump_stack_lvl+0x78/0x90
>    print_address_description.constprop.0+0x88/0x398
>    print_report+0xa8/0x278
>    kasan_report+0xa8/0xf8
>    __asan_load8+0x9c/0xc0
>    mac802154_rx_mac_cmd_worker+0xc0/0x498 [mac802154]
>    process_one_work+0x334/0x8b8
>   ...
>   Allocated by task 630:
>    kasan_save_stack+0x2c/0x58
>    kasan_save_track+0x20/0x40
>    kasan_save_alloc_info+0x40/0x58
>    __kasan_kmalloc+0xa0/0xb8
>    __kvmalloc_node_noprof+0x1e8/0x588
>    alloc_netdev_mqs+0x74/0x7f0
>    ieee802154_if_add+0xac/0x630 [mac802154]
>    ieee802154_register_hw+0x31c/0x3d0 [mac802154]
>    fakelb_add_one+0x250/0x318 [fakelb]
>   ...
>   Freed by task 652:
>    kasan_save_stack+0x2c/0x58
>    kasan_save_track+0x20/0x40
>    kasan_save_free_info+0x4c/0x78
>    __kasan_slab_free+0x60/0x90
>    kfree+0x194/0x478
>    kvfree+0x44/0x60
>    netdev_release+0x4c/0x68
>    device_release+0xac/0x130
>    kobject_cleanup+0x84/0x248
>    kobject_put+0x98/0xf8
>    netdev_run_todo+0x3a0/0x5e0
>    rtnl_unlock+0x18/0x30
>    ieee802154_unregister_hw+0x48/0x90 [mac802154]
>    fakelb_remove+0xe8/0x148 [fakelb]
>
> Hold the receiving netdev from before a descriptor is queued until the
> descriptor is released. Since sdata is the netdev's private data, this also
> keeps sdata valid while a worker or scan cleanup accesses the descriptor.
>
> Fixes: 57588c71177f ("mac802154: Handle passive scanning")
> Fixes: d021d218f6d9 ("mac802154: Handle received BEACON_REQ")
> Cc: stable@vger.kernel.org
> Signed-off-by: Xuanqiang Luo <luoxuanqiang@kylinos.cn>

Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>

Re: [PATCH net v2 0/2] mac802154: fix queued RX descriptor lifetime

[Xuanqiang Luo]

在 2026/9/3 20:32, Xuanqiang Luo 写道:
> From: Xuanqiang Luo<luoxuanqiang@kylinos.cn>
>
> mac802154 queues one descriptor per received beacon or MAC command, but
> each worker invocation dequeues only one. Since queue_work() coalesces
> attempts to queue the same pending work item, a burst can add more
> descriptors than scheduled invocations. A later frame may schedule another
> invocation, but also adds a descriptor, so it does not necessarily reduce
> the backlog. Descriptors can therefore remain queued indefinitely once
> reception stops. The RX path, workers, and scan cleanup also access the
> descriptor lists without common synchronization.
>
> A queued descriptor carries its receiving interface beyond the RCU
> read-side critical section without holding a netdev reference. If the
> interface is removed first, the worker can dereference freed memory.
>
> Protect the descriptor lists with a spinlock and keep the workers running
> until the queues are empty. Then hold the netdev for the lifetime of each
> queued descriptor to prevent it from being freed too early.
>
> This ordering is required. Without the queue-draining fix, a descriptor
> stranded by queue_work() coalescing would also strand its netdev reference,
> as netdev_put() runs only when the descriptor is released, leaving the
> netdev pinned indefinitely.
>
> ---
> Changes:
> v2:
>    Patch 1 (new):
>    - Serialize descriptor list access and requeue each worker while another
>      descriptor remains.
>    - Detach queued beacons under the same lock before scan cleanup frees
>      them.
>
>    Patch 2:
>    - Replace the v1 drain_workqueue() approach, which does not cover work
>      queued after the drain or the DEL_INTERFACE path, with a netdev
>      reference held by each queued descriptor. (Sashiko.)
>
> v1:https://lore.kernel.org/all/20260828101905.26865-1-xuanqiang.luo@linux.dev/
>
> Xuanqiang Luo (2):
>    mac802154: serialize and drain queued RX descriptors
>    mac802154: pin netdevs for queued RX descriptors
>
>   include/net/cfg802154.h      |  2 ++
>   net/mac802154/ieee802154_i.h |  2 ++
>   net/mac802154/main.c         |  1 +
>   net/mac802154/rx.c           | 36 ++++++++++++++++++++++++++++++------
>   net/mac802154/scan.c         |  8 +++++++-
>   5 files changed, 42 insertions(+), 7 deletions(-)
>
>
> base-commit: dc4b95b8fee95113587e93ca116356032d271371

I realized that the issues addressed by this series appear to have
already been fixed by:

https://lore.kernel.org/all/20260725135154.99876-1-security@auditcode.ai/

I missed that, so please disregard this one.

Thanks,

pw-bot: rejected