mcp251xfd_open() allocates priv->wq after the controller is started.
If request_threaded_irq() or mcp251xfd_chip_interrupts_enable() fails,
the error path destroys the workqueue but leaves priv->wq unchanged.

This leaves a dangling non-NULL pointer that can later be destroyed
again, for example:
- a retry to open the device fails before priv->wq is reallocated and a
  later close/remove cleanup destroys the stale pointer; or
- reset/recovery paths end up calling mcp251xfd_stop() after the failed
  open and destroy priv->wq again.

Clear priv->wq after destroy_workqueue() to make teardown idempotent and
avoid double-destroy/use-after-free crashes.

This is the same bug class as CVE-2024-26802 (stmmac workqueue teardown).

Signed-off-by: Kery Qi <qikeyu2017@gmail.com>
---
 drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c b/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c
index 5134ebb85880..c5ac0c8a6e08 100644
--- a/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c
+++ b/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c
@@ -1661,6 +1661,8 @@ static int mcp251xfd_open(struct net_device *ndev)
 	free_irq(spi->irq, priv);
 out_destroy_workqueue:
 	destroy_workqueue(priv->wq);
+	if (priv->wq)
+		priv->wq = NULL;
 out_can_rx_offload_disable:
 	can_rx_offload_disable(&priv->offload);
 	set_bit(MCP251XFD_FLAGS_DOWN, priv->flags);
-- 
2.34.1

On 08.01.2026 16:20:42, Kery Qi wrote:
> mcp251xfd_open() allocates priv->wq after the controller is started.
> If request_threaded_irq() or mcp251xfd_chip_interrupts_enable() fails,
> the error path destroys the workqueue but leaves priv->wq unchanged.
>
> This leaves a dangling non-NULL pointer that can later be destroyed
> again, for example:
> - a retry to open the device fails before priv->wq is reallocated and a
>   later close/remove cleanup destroys the stale pointer; or

Can you point me to the exact code path.

> - reset/recovery paths end up calling mcp251xfd_stop() after the failed
>   open and destroy priv->wq again.

mcp251xfd_stop() is only called from net_device_ops:

| static const struct net_device_ops mcp251xfd_netdev_ops = {
| 	.ndo_stop = mcp251xfd_stop,
| }

Is this ndo_stop is called if ndo_open failed?

> Clear priv->wq after destroy_workqueue() to make teardown idempotent and
> avoid double-destroy/use-after-free crashes.
>
> This is the same bug class as CVE-2024-26802 (stmmac workqueue teardown).

regards,
Marc

-- 
Pengutronix e.K.                 | Marc Kleine-Budde          |
Embedded Linux                   | https://www.pengutronix.de |
Vertretung Nürnberg              | Phone: +49-5121-206917-129 |
Amtsgericht Hildesheim, HRA 2686 | Fax:   +49-5121-206917-9   |