Re: [PATCH net 1/1] mac802154: fix netdev use-after-free in beacon worker

[Stefan Schmidt <stefan@datenfreihafen.org>]

Hello Zihan,

On 9/2/26 12:16, zihan xi wrote:
> On Wed, Sep 2, 2026 at 4:15 PM Stefan Schmidt <stefan@datenfreihafen.org> wrote:
>>
>> Hello Zihan,
>>
>> On 8/2/26 11:23, Zihan Xi wrote:
>>> mac802154_beacon_worker() reads local->beacon_req under RCU and derives
>>> the sub-interface from the request, but then drops the RCU read lock and
>>> continues to use both sdata and the embedded wpan_dev.
>>>
>>> mac802154_stop_beacons_locked() cancels only pending beacon work, clears
>>> local->beacon_req and frees the request.  A beacon worker that is already
>>> running can therefore continue after interface teardown and dereference
>>> the freed netdev private area.
>>>
>>> The scan worker already pins the netdev before leaving RCU.  Apply the
>>> same lifetime rule to the beacon worker: take a netdev reference while
>>> the request is still protected by RCU, and release it on all paths that
>>> continue after the reference is acquired.
>>>
>>> Fixes: 3accf4762734 ("mac802154: Handle basic beaconing")
>>> Cc: stable@vger.kernel.org
>>> Reported-by: Vega <vega@nebusec.ai>
>>> Assisted-by: Codex:gpt-5.4
>>> Signed-off-by: Zihan Xi <zihanx@nebusec.ai>
>>> ---
>>>    net/mac802154/scan.c | 4 ++++
>>>    1 file changed, 4 insertions(+)
>>>
>>> diff --git a/net/mac802154/scan.c b/net/mac802154/scan.c
>>> index 65089826f..ebd092d40 100644
>>> --- a/net/mac802154/scan.c
>>> +++ b/net/mac802154/scan.c
>>> @@ -416,6 +416,7 @@ void mac802154_beacon_worker(struct work_struct *work)
>>>        struct cfg802154_beacon_request *beacon_req;
>>>        struct ieee802154_sub_if_data *sdata;
>>>        struct wpan_dev *wpan_dev;
>>> +     netdevice_tracker dev_tracker;
>>>        u8 interval;
>>>        int ret;
>>>
>>> @@ -427,12 +428,14 @@ void mac802154_beacon_worker(struct work_struct *work)
>>>        }
>>>
>>>        sdata = IEEE802154_WPAN_DEV_TO_SUB_IF(beacon_req->wpan_dev);
>>> +     netdev_hold(sdata->dev, &dev_tracker, GFP_ATOMIC);
>>>
>>>        /* Wait an arbitrary amount of time in case we cannot use the device */
>>>        if (local->suspended || !ieee802154_sdata_running(sdata)) {
>>>                rcu_read_unlock();
>>>                queue_delayed_work(local->mac_wq, &local->beacon_work,
>>>                                   msecs_to_jiffies(1000));
>>> +             netdev_put(sdata->dev, &dev_tracker);
>>>                return;
>>>        }
>>>
>>> @@ -450,6 +453,7 @@ void mac802154_beacon_worker(struct work_struct *work)
>>>        if (interval < IEEE802154_ACTIVE_SCAN_DURATION)
>>>                queue_delayed_work(local->mac_wq, &local->beacon_work,
>>>                                   local->beacon_interval);
>>> +     netdev_put(sdata->dev, &dev_tracker);
>>>    }
>>>
>>>    int mac802154_stop_beacons_locked(struct ieee802154_local *local,
>>
>>
>> This patch does no longer apply. Please rebase and re-send.
>>
>> regards
>> Stefan Schmidt
> 
> Hi Stefan,
> 
> thanks for taking a look.
> 
> This change already landed in net.git as 5f26a690e8ef
> ("mac802154: fix netdev use-after-free in beacon worker"),
> applied by Jakub with Miquel's Reviewed-by.

Ah, I missed that Jakub took it already. Thanks.

> If wpan.git still needs a rebased copy, I can send that. Otherwise
> I will leave it as is to avoid a duplicate.

No need. Its fine as is now.

regards
Stefan Schmidt