Re: [PATCH net 1/1] mac802154: fix netdev use-after-free in beacon worker

[Stefan Schmidt <stefan@datenfreihafen.org>]

Hello Zihan,

On 8/2/26 11:23, Zihan Xi wrote:
> mac802154_beacon_worker() reads local->beacon_req under RCU and derives
> the sub-interface from the request, but then drops the RCU read lock and
> continues to use both sdata and the embedded wpan_dev.
> 
> mac802154_stop_beacons_locked() cancels only pending beacon work, clears
> local->beacon_req and frees the request.  A beacon worker that is already
> running can therefore continue after interface teardown and dereference
> the freed netdev private area.
> 
> The scan worker already pins the netdev before leaving RCU.  Apply the
> same lifetime rule to the beacon worker: take a netdev reference while
> the request is still protected by RCU, and release it on all paths that
> continue after the reference is acquired.
> 
> Fixes: 3accf4762734 ("mac802154: Handle basic beaconing")
> Cc: stable@vger.kernel.org
> Reported-by: Vega <vega@nebusec.ai>
> Assisted-by: Codex:gpt-5.4
> Signed-off-by: Zihan Xi <zihanx@nebusec.ai>
> ---
>   net/mac802154/scan.c | 4 ++++
>   1 file changed, 4 insertions(+)
> 
> diff --git a/net/mac802154/scan.c b/net/mac802154/scan.c
> index 65089826f..ebd092d40 100644
> --- a/net/mac802154/scan.c
> +++ b/net/mac802154/scan.c
> @@ -416,6 +416,7 @@ void mac802154_beacon_worker(struct work_struct *work)
>   	struct cfg802154_beacon_request *beacon_req;
>   	struct ieee802154_sub_if_data *sdata;
>   	struct wpan_dev *wpan_dev;
> +	netdevice_tracker dev_tracker;
>   	u8 interval;
>   	int ret;
>   
> @@ -427,12 +428,14 @@ void mac802154_beacon_worker(struct work_struct *work)
>   	}
>   
>   	sdata = IEEE802154_WPAN_DEV_TO_SUB_IF(beacon_req->wpan_dev);
> +	netdev_hold(sdata->dev, &dev_tracker, GFP_ATOMIC);
>   
>   	/* Wait an arbitrary amount of time in case we cannot use the device */
>   	if (local->suspended || !ieee802154_sdata_running(sdata)) {
>   		rcu_read_unlock();
>   		queue_delayed_work(local->mac_wq, &local->beacon_work,
>   				   msecs_to_jiffies(1000));
> +		netdev_put(sdata->dev, &dev_tracker);
>   		return;
>   	}
>   
> @@ -450,6 +453,7 @@ void mac802154_beacon_worker(struct work_struct *work)
>   	if (interval < IEEE802154_ACTIVE_SCAN_DURATION)
>   		queue_delayed_work(local->mac_wq, &local->beacon_work,
>   				   local->beacon_interval);
> +	netdev_put(sdata->dev, &dev_tracker);
>   }
>   
>   int mac802154_stop_beacons_locked(struct ieee802154_local *local,


This patch does no longer apply. Please rebase and re-send.

regards
Stefan Schmidt