Re: [PATCH net 1/1] mac802154: fix netdev use-after-free in beacon worker

[Miquel Raynal <miquel.raynal@bootlin.com>]

On 02/08/2026 at 09:23:34 GMT, Zihan Xi <zihanx@nebusec.ai> wrote:

> mac802154_beacon_worker() reads local->beacon_req under RCU and derives
> the sub-interface from the request, but then drops the RCU read lock and
> continues to use both sdata and the embedded wpan_dev.
>
> mac802154_stop_beacons_locked() cancels only pending beacon work, clears
> local->beacon_req and frees the request.  A beacon worker that is already
> running can therefore continue after interface teardown and dereference
> the freed netdev private area.
>
> The scan worker already pins the netdev before leaving RCU.  Apply the
> same lifetime rule to the beacon worker: take a netdev reference while
> the request is still protected by RCU, and release it on all paths that
> continue after the reference is acquired.
>
> Fixes: 3accf4762734 ("mac802154: Handle basic beaconing")
> Cc: stable@vger.kernel.org
> Reported-by: Vega <vega@nebusec.ai>
> Assisted-by: Codex:gpt-5.4
> Signed-off-by: Zihan Xi <zihanx@nebusec.ai>

Looks okay.

Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>

Thanks,
Miquèl