From: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
To: Alexander Aring <alex.aring@gmail.com>,
Stefan Schmidt <stefan@datenfreihafen.org>,
Miquel Raynal <miquel.raynal@bootlin.com>
Cc: Shuangpeng Bai <shuangpeng.kernel@gmail.com>,
"David S. Miller" <davem@davemloft.net>,
Eric Dumazet <edumazet@google.com>,
Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>,
Simon Horman <horms@kernel.org>,
linux-wpan@vger.kernel.org, netdev@vger.kernel.org,
linux-kernel@vger.kernel.org
Subject: [BUG] mac802154: KASAN slab-use-after-free in mac802154_rx_mac_cmd_worker
Date: Wed, 22 Jul 2026 23:37:58 -0400 [thread overview]
Message-ID: <20260723033829.764639-1-shuangpeng.kernel@gmail.com> (raw)
Hi Kernel Maintainers,
I hit the following report while testing current upstream kernel:
KASAN: slab-use-after-free in mac802154_rx_mac_cmd_worker
on commit: fce2dfa773ced15f27dd27cd0b482a7473cdcf2a (Jul 16 2026)
To help trigger the bug more reliably, we applied a minimal diagnostic patch
that only adds delays and print statements.
The reproducer and .config files are here.
https://gist.github.com/shuangpengbai/ea5e98e729d2ae8cb1e9481b5c315ab8
I'm happy to test debug patches or provide additional information.
Reported-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
[ 376.015401][ T12] BUG: KASAN: slab-use-after-free in mac802154_rx_mac_cmd_worker (net/mac802154/rx.c:110)
[ 376.016760][ T12] Read of size 4 at addr ffff888115e78b58 by task kworker/u8:0/12
[ 376.017796][ T12]
[ 376.018231][ T12] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 376.018237][ T12] Workqueue: phy1-mac-cmds mac802154_rx_mac_cmd_worker
[ 376.018270][ T12] Call Trace:
[ 376.018292][ T12] <TASK>
[ 376.018302][ T12] dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)
[ 376.018393][ T12] print_report (mm/kasan/report.c:378 mm/kasan/report.c:482)
[ 376.018529][ T12] kasan_report (mm/kasan/report.c:595)
[ 376.018543][ T12] mac802154_rx_mac_cmd_worker (net/mac802154/rx.c:110)
[ 376.018560][ T12] process_scheduled_works (kernel/workqueue.c:3322 kernel/workqueue.c:3405)
[ 376.018589][ T12] worker_thread (kernel/workqueue.c:3486)
[ 376.018599][ T12] kthread (kernel/kthread.c:436)
[ 376.018647][ T12] ret_from_fork (archkernel/process.c:158)
[ 376.018735][ T12] ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
[ 376.018754][ T12] </TASK>
[ 376.018758][ T12]
[ 376.032833][ T12] Freed by task 8455 on cpu 0 at 375.611793s:
[ 376.033290][ T12] kasan_save_track (mm/kasan/common.c:57 mm/kasan/common.c:78)
[ 376.033651][ T12] kasan_save_free_info (mm/kasan/generic.c:584)
[ 376.034018][ T12] __kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285)
[ 376.034371][ T12] kfree (./include/linux/kasan.h:235 mm/slub.c:2705 mm/slub.c:6405 mm/slub.c:6720)
[ 376.034677][ T12] device_release (drivers/gpu/drm/vkms/vkms_configfs.c:690)
[ 376.035065][ T12] kobject_put (lib/kobject.c:689 lib/kobject.c:720 ./include/linux/kref.h:65 lib/kobject.c:737)
[ 376.035413][ T12] netdev_run_todo (net/core/dev.c:11749)
[ 376.035808][ T12] genl_family_rcv_msg_doit (net/netlink/genetlink.c:1117)
[ 376.036235][ T12] genl_rcv_msg (net/netlink/genetlink.c:1194 net/netlink/genetlink.c:1209)
[ 376.036574][ T12] netlink_rcv_skb (net/netlink/af_netlink.c:2556)
[ 376.036933][ T12] genl_rcv (net/netlink/genetlink.c:1218)
[ 376.037233][ T12] netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1345)
[ 376.037584][ T12] netlink_sendmsg (net/netlink/af_netlink.c:1900)
[ 376.037930][ T12] __sock_sendmsg (net/socket.c:775 net/socket.c:790)
[ 376.038335][ T12] __sys_sendto (net/socket.c:2252)
[ 376.038676][ T12] __x64_sys_sendto (net/socket.c:2259 net/socket.c:2255 net/socket.c:2255)
[ 376.039018][ T12] do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
[ 376.039455][ T12] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
[ 376.039998][ T12]
[ 376.040171][ T12] The buggy address belongs to the object at ffff888115e78000
[ 376.040171][ T12] which belongs to the cache kmalloc-cg-8k of size 8192
[ 376.041250][ T12] The buggy address is located 2904 bytes inside of
[ 376.041250][ T12] freed 8192-byte region [ffff888115e78000, ffff888115e7a000)
[ 376.042239][ T12]
[ 376.042414][ T12] The buggy address belongs to the physical page:
Best,
Shuangpeng
reply other threads:[~2026-07-23 3:39 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260723033829.764639-1-shuangpeng.kernel@gmail.com \
--to=shuangpeng.kernel@gmail.com \
--cc=alex.aring@gmail.com \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=horms@kernel.org \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-wpan@vger.kernel.org \
--cc=miquel.raynal@bootlin.com \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=stefan@datenfreihafen.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox