[PATCH net] mac802154: use pinned interface for beacon transmission

[PATCH net] mac802154: use pinned interface for beacon transmission

[Yifan Zhang]

>From 1e3faf146431b4c28bdf0923fa54754c1f8d8902 Mon Sep 17 00:00:00 2001
From: Yifan Zhang <yfzhang23@stu.pku.edu.cn>
Date: Wed, 28 Oct 2026 17:18:59 +0800
Subject: [PATCH net] mac802154: use pinned interface for beacon transmission

mac802154_beacon_worker() looks up beacon_req under RCU and takes a
reference on the selected interface's netdev before dropping the RCU read
lock. It then passes the selected wpan_dev to
mac802154_transmit_beacon().

mac802154_transmit_beacon() ignores that argument when choosing sdata and
reads local->beacon_req again. If the beacon request switches to another
interface between the two reads, the worker pins the old interface while
the transmit path uses the new one. Removing the new interface can then
free its netdev before ieee802154_mlme_tx_locked() dereferences it,
causing a KASAN use-after-free.

Derive sdata from the wpan_dev already selected and pinned by the worker.
This also removes the redundant RCU lookup.

The reproducer hit the use-after-free on two separate v7.3 KASAN boots
before this change and completed without a KASAN report in three runs
afterward.

Fixes: 5f26a690e8ef ("mac802154: fix netdev use-after-free in beacon worker")
Cc: stable@vger.kernel.org
Signed-off-by: Yifan Zhang <yfzhang23@stu.pku.edu.cn>
---
 net/mac802154/scan.c | 13 +------------
 1 file changed, 1 insertion(+), 12 deletions(-)

diff --git a/net/mac802154/scan.c b/net/mac802154/scan.c
index d393b1f..9f0e45b 100644
--- a/net/mac802154/scan.c
+++ b/net/mac802154/scan.c
@@ -353,7 +353,6 @@ int mac802154_process_beacon(struct ieee802154_local *local,
 static int mac802154_transmit_beacon(struct ieee802154_local *local,
 				     struct wpan_dev *wpan_dev)
 {
-	struct cfg802154_beacon_request *beacon_req;
 	struct ieee802154_sub_if_data *sdata;
 	struct sk_buff *skb;
 	int ret;
@@ -365,19 +364,9 @@ static int mac802154_transmit_beacon(struct ieee802154_local *local,
 	if (!skb)
 		return -ENOBUFS;
 
-	rcu_read_lock();
-	beacon_req = rcu_dereference(local->beacon_req);
-	if (unlikely(!beacon_req)) {
-		rcu_read_unlock();
-		kfree_skb(skb);
-		return -EINVAL;
-	}
-
-	sdata = IEEE802154_WPAN_DEV_TO_SUB_IF(beacon_req->wpan_dev);
+	sdata = IEEE802154_WPAN_DEV_TO_SUB_IF(wpan_dev);
 	skb->dev = sdata->dev;
 
-	rcu_read_unlock();
-
 	ret = ieee802154_beacon_push(skb, &local->beacon);
 	if (ret) {
 		kfree_skb(skb);
-- 
2.39.5 (Apple Git-154)

Re: [PATCH net] mac802154: use pinned interface for beacon transmission

[netdev-bot+sinfo]

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - How the issue was discovered, e.g. hit in production, hit during
   development, syzbot report, manual code inspection, LLM or static
   analysis tool scan.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.

Re: [PATCH net] mac802154: use pinned interface for beacon transmission

[Miquel Raynal]

Hi Yifan,

On 30/10/2026 at 17:36:14 +08, Yifan Zhang <yfzhang23@stu.pku.edu.cn> wrote:

>>From 1e3faf146431b4c28bdf0923fa54754c1f8d8902 Mon Sep 17 00:00:00 2001
> From: Yifan Zhang <yfzhang23@stu.pku.edu.cn>
> Date: Wed, 28 Oct 2026 17:18:59 +0800
> Subject: [PATCH net] mac802154: use pinned interface for beacon
> transmission

These lines should be in the header, they appear in the body. Something
is wrong with the contribution. You can use a tool such as b4 to help
you with this setup.

> mac802154_beacon_worker() looks up beacon_req under RCU and takes a
> reference on the selected interface's netdev before dropping the RCU read
> lock. It then passes the selected wpan_dev to
> mac802154_transmit_beacon().
>
> mac802154_transmit_beacon() ignores that argument when choosing sdata and
> reads local->beacon_req again. If the beacon request switches to another
> interface between the two reads, the worker pins the old interface while
> the transmit path uses the new one. Removing the new interface can then
> free its netdev before ieee802154_mlme_tx_locked() dereferences it,
> causing a KASAN use-after-free.
>
> Derive sdata from the wpan_dev already selected and pinned by the worker.
> This also removes the redundant RCU lookup.
>
> The reproducer hit the use-after-free on two separate v7.3 KASAN boots
> before this change and completed without a KASAN report in three runs
> afterward.
>
> Fixes: 5f26a690e8ef ("mac802154: fix netdev use-after-free in beacon worker")
> Cc: stable@vger.kernel.org
> Signed-off-by: Yifan Zhang <yfzhang23@stu.pku.edu.cn>
> ---

With the commit fixed,

Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>

Thanks,
Miquèl