From nobody Sat Sep 26 07:59:35 2026 Received: from mta0.migadu.com (out-79.mta0.migadu.com [91.218.175.79]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 04BB84A386A for ; Thu, 3 Sep 2026 12:32:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.79 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788438769; cv=none; b=ZILcIA1yLzZIfBVRDcmEvR57fF4vRd1z7k4CSSqEwvvclwZyHGcW45Irr4TB3uWp5DtyMWSwQSfcFGZu/dbezW0Cu/WP8Zkje/y40JN6EJ53XWNrxA++3xOiHgEiUii+Q2pPZ2zx9hqyjLdkXArmTLpUErSi2rKo7Osm3u7EBvk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788438769; c=relaxed/simple; bh=ixQKr71X/Ud/HwrSzOrIph9nLjmLhV+az2lfLYT3OYY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=uhYHfbaoouSx3OtdDsr49Ozz0whp0fPC4eASdM50lvj02rCGt42+3bBZG1KLXngvB/kdNAnRYOipe8haMZuRYVwlbOATNXCLqZLT/WAVFUqiKhvA2JaaLVjDUMog1sik6XlvYdQt2LGw4b5zj1/T8rwiIi07hUAAZ1cL4L/iv1g= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=e74GLdYc; arc=none smtp.client-ip=91.218.175.79 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="e74GLdYc" X-Envelope-To: linux-kernel@vger.kernel.org DKIM-Signature: a=rsa-sha256; bh=ixQKr71X/Ud/HwrSzOrIph9nLjmLhV+az2lfLYT3OYY=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1788438764; v=1; x=1789043564; b=e74GLdYcQ/bH09UBOcB/qiGqXCb87Ar/pUoInA109CvyJ8FiDa9lNljSHvIQbZUiGpRA15Sv rea3WW2GfsgcsYxpnRtyNFc8ddh2lgV6jSzkhYEr+hbXCLwC8yUXkh9wDK6fGUgshIT98GT7E+e 3dE0t3GPNzsgLQ7UVE9EP7T0= X-Envelope-To: linux-kernel@vger.kernel.org Received: by smtp.migadu.com with ESMTPS id b4d47bdebe95483d; Thu, 03 Sep 2026 12:32:44 +0000 X-Mizu-Trace-ID: b4d47bdebe95483d X-Migadu-Flow: FLOW_OUT From: Xuanqiang Luo To: linux-wpan@vger.kernel.org Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org, alex.aring@gmail.com, stefan@datenfreihafen.org, miquel.raynal@bootlin.com, david.girault@qorvo.com, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, horms@kernel.org, stable@vger.kernel.org, Xuanqiang Luo Subject: [PATCH net v2 1/2] mac802154: serialize and drain queued RX descriptors Date: Thu, 3 Sep 2026 20:32:01 +0800 Message-ID: <20260903123202.60152-2-xuanqiang.luo@linux.dev> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260903123202.60152-1-xuanqiang.luo@linux.dev> References: <20260903123202.60152-1-xuanqiang.luo@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Xuanqiang Luo queue_work() coalesces attempts to queue an already pending work item. The RX workers, however, consume only one descriptor per invocation. A burst can therefore leave later descriptors queued until another frame arrives, while the final descriptor may remain queued indefinitely. The RX tasklet, workers, and scan cleanup also access the descriptor lists without synchronization. Protect both lists with a spinlock. Publish each descriptor and queue its work while holding the lock. Remove each descriptor from the list before processing it and, if another descriptor remains, queue the work again so it runs after the current invocation. Fixes: 57588c71177f ("mac802154: Handle passive scanning") Fixes: d021d218f6d9 ("mac802154: Handle received BEACON_REQ") Cc: stable@vger.kernel.org Signed-off-by: Xuanqiang Luo Reviewed-by: Miquel Raynal --- net/mac802154/ieee802154_i.h | 2 ++ net/mac802154/main.c | 1 + net/mac802154/rx.c | 32 ++++++++++++++++++++++++++------ net/mac802154/scan.c | 7 ++++++- 4 files changed, 35 insertions(+), 7 deletions(-) diff --git a/net/mac802154/ieee802154_i.h b/net/mac802154/ieee802154_i.h index 8f2bff268392b..096e6f0340dc7 100644 --- a/net/mac802154/ieee802154_i.h +++ b/net/mac802154/ieee802154_i.h @@ -74,6 +74,8 @@ struct ieee802154_local { struct work_struct rx_beacon_work; struct list_head rx_mac_cmd_list; struct work_struct rx_mac_cmd_work; + /* Protects rx_beacon_list and rx_mac_cmd_list. */ + spinlock_t rx_lists_lock; =20 /* Association */ struct ieee802154_pan_device *assoc_dev; diff --git a/net/mac802154/main.c b/net/mac802154/main.c index ea1efef3572ae..a6a976b0dea56 100644 --- a/net/mac802154/main.c +++ b/net/mac802154/main.c @@ -91,6 +91,7 @@ ieee802154_alloc_hw(size_t priv_data_len, const struct ie= ee802154_ops *ops) INIT_LIST_HEAD(&local->interfaces); INIT_LIST_HEAD(&local->rx_beacon_list); INIT_LIST_HEAD(&local->rx_mac_cmd_list); + spin_lock_init(&local->rx_lists_lock); mutex_init(&local->iflist_mtx); =20 tasklet_setup(&local->tasklet, ieee802154_tasklet_handler); diff --git a/net/mac802154/rx.c b/net/mac802154/rx.c index cd8f2a11920d0..26da20ea470ef 100644 --- a/net/mac802154/rx.c +++ b/net/mac802154/rx.c @@ -29,20 +29,38 @@ static int ieee802154_deliver_skb(struct sk_buff *skb) return netif_receive_skb(skb); } =20 +static struct cfg802154_mac_pkt * +mac802154_rx_dequeue(struct ieee802154_local *local, + struct list_head *rx_list, + struct work_struct *work) +{ + struct cfg802154_mac_pkt *mac_pkt; + + spin_lock_bh(&local->rx_lists_lock); + mac_pkt =3D list_first_entry_or_null(rx_list, + struct cfg802154_mac_pkt, node); + if (mac_pkt) { + list_del(&mac_pkt->node); + if (!list_empty(rx_list)) + queue_work(local->mac_wq, work); + } + spin_unlock_bh(&local->rx_lists_lock); + + return mac_pkt; +} + void mac802154_rx_beacon_worker(struct work_struct *work) { struct ieee802154_local *local =3D container_of(work, struct ieee802154_local, rx_beacon_work); struct cfg802154_mac_pkt *mac_pkt; =20 - mac_pkt =3D list_first_entry_or_null(&local->rx_beacon_list, - struct cfg802154_mac_pkt, node); + mac_pkt =3D mac802154_rx_dequeue(local, &local->rx_beacon_list, work); if (!mac_pkt) return; =20 mac802154_process_beacon(local, mac_pkt->skb, mac_pkt->page, mac_pkt->cha= nnel); =20 - list_del(&mac_pkt->node); kfree_skb(mac_pkt->skb); kfree(mac_pkt); } @@ -76,8 +94,7 @@ void mac802154_rx_mac_cmd_worker(struct work_struct *work) u8 mac_cmd; int rc; =20 - mac_pkt =3D list_first_entry_or_null(&local->rx_mac_cmd_list, - struct cfg802154_mac_pkt, node); + mac_pkt =3D mac802154_rx_dequeue(local, &local->rx_mac_cmd_list, work); if (!mac_pkt) return; =20 @@ -123,7 +140,6 @@ void mac802154_rx_mac_cmd_worker(struct work_struct *wo= rk) } =20 out: - list_del(&mac_pkt->node); kfree_skb(mac_pkt->skb); kfree(mac_pkt); } @@ -221,8 +237,10 @@ ieee802154_subif_frame(struct ieee802154_sub_if_data *= sdata, mac_pkt->sdata =3D sdata; mac_pkt->page =3D sdata->local->scan_page; mac_pkt->channel =3D sdata->local->scan_channel; + spin_lock_bh(&sdata->local->rx_lists_lock); list_add_tail(&mac_pkt->node, &sdata->local->rx_beacon_list); queue_work(sdata->local->mac_wq, &sdata->local->rx_beacon_work); + spin_unlock_bh(&sdata->local->rx_lists_lock); return NET_RX_SUCCESS; =20 case IEEE802154_FC_TYPE_MAC_CMD: @@ -233,8 +251,10 @@ ieee802154_subif_frame(struct ieee802154_sub_if_data *= sdata, =20 mac_pkt->skb =3D skb_get(skb); mac_pkt->sdata =3D sdata; + spin_lock_bh(&sdata->local->rx_lists_lock); list_add_tail(&mac_pkt->node, &sdata->local->rx_mac_cmd_list); queue_work(sdata->local->mac_wq, &sdata->local->rx_mac_cmd_work); + spin_unlock_bh(&sdata->local->rx_lists_lock); return NET_RX_SUCCESS; =20 case IEEE802154_FC_TYPE_ACK: diff --git a/net/mac802154/scan.c b/net/mac802154/scan.c index 005338f89b75e..5fa98e001a8fb 100644 --- a/net/mac802154/scan.c +++ b/net/mac802154/scan.c @@ -105,8 +105,13 @@ static unsigned int mac802154_scan_get_channel_time(u8= duration_order, static void mac802154_flush_queued_beacons(struct ieee802154_local *local) { struct cfg802154_mac_pkt *mac_pkt, *tmp; + LIST_HEAD(mac_pkt_list); =20 - list_for_each_entry_safe(mac_pkt, tmp, &local->rx_beacon_list, node) { + spin_lock_bh(&local->rx_lists_lock); + list_splice_init(&local->rx_beacon_list, &mac_pkt_list); + spin_unlock_bh(&local->rx_lists_lock); + + list_for_each_entry_safe(mac_pkt, tmp, &mac_pkt_list, node) { list_del(&mac_pkt->node); kfree_skb(mac_pkt->skb); kfree(mac_pkt); --=20 2.43.0 From nobody Sat Sep 26 07:59:35 2026 Received: from mta1.migadu.com (out-143.mta1.migadu.com [95.215.58.143]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E576A4A485A for ; Thu, 3 Sep 2026 12:32:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=95.215.58.143 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788438780; cv=none; b=TEZjAg2MPQ+QVseGHWuESWr75lncpDo5RVd/DVLRL7LjkL/Nu48qhCGisrOD9YYpkt2ypJUUwYY6/wowApAEeAPY+AYzHtjt53AfKqlyLXxRKs54HX9v4Ch+R1QgQVt0Cc1EguiNPXf/8WnLx++JB1SaEm0aVb1TIbn+MA1ul64= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788438780; c=relaxed/simple; bh=1iB/o8bZw94ZM1/04pVnXdKi6vlIvmj3KTplXfVEHY8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ry+wEsU9R/PGBOk1h8rGc8BiRbkk/+BHQCHvvNd7zyU0Sjr+WOTN47iXxsfi7ExOhf+zbX14IVaPy+lZNmPzGCZdUOJmVwswF515CQT6b6TGawLUfXhmhKrx5fMEC4m9U5gSEVJMDvk/gr0gjg0XSi6Ad3kNF+CVRc8ki4Zisd0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=GnYSQNz2; arc=none smtp.client-ip=95.215.58.143 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="GnYSQNz2" X-Envelope-To: linux-kernel@vger.kernel.org DKIM-Signature: a=rsa-sha256; bh=1iB/o8bZw94ZM1/04pVnXdKi6vlIvmj3KTplXfVEHY8=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1788438776; v=1; x=1789043576; b=GnYSQNz2fQBdKHJRcFxw5U1sEWVwiixC9V32gjo1LlJ39ZAIcQFXVzRgftKIsynpkzKV6N/M ITToR34WvDqIdtrTWGvq+VxycuVNQ3H9JVMXPUSr4UglO/hPfoIxtGoq4WrX06opasVv2AvlOmq IWlhfn8x7wBYqX59ROL+2Iio= X-Envelope-To: linux-kernel@vger.kernel.org Received: by smtp.migadu.com with ESMTPS id 88afac023ae83057; Thu, 03 Sep 2026 12:32:56 +0000 X-Mizu-Trace-ID: 88afac023ae83057 X-Migadu-Flow: FLOW_OUT From: Xuanqiang Luo To: linux-wpan@vger.kernel.org Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org, alex.aring@gmail.com, stefan@datenfreihafen.org, miquel.raynal@bootlin.com, david.girault@qorvo.com, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, horms@kernel.org, stable@vger.kernel.org, Xuanqiang Luo Subject: [PATCH net v2 2/2] mac802154: pin netdevs for queued RX descriptors Date: Thu, 3 Sep 2026 20:32:02 +0800 Message-ID: <20260903123202.60152-3-xuanqiang.luo@linux.dev> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260903123202.60152-1-xuanqiang.luo@linux.dev> References: <20260903123202.60152-1-xuanqiang.luo@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Xuanqiang Luo The RX path keeps the receiving sub-interface in queued beacon and MAC command descriptors after leaving its RCU read-side critical section. An interface can therefore be unregistered and freed before mac_wq consumes the descriptor, leading to a use-after-free such as: BUG: KASAN: slab-use-after-free in mac802154_rx_mac_cmd_worker+0xc0/0x498= [mac802154] Read of size 8 at addr ffff0000c6db0ba8 by task kworker/u16:3/61 ... Call trace: show_stack+0x20/0x38 (C) dump_stack_lvl+0x78/0x90 print_address_description.constprop.0+0x88/0x398 print_report+0xa8/0x278 kasan_report+0xa8/0xf8 __asan_load8+0x9c/0xc0 mac802154_rx_mac_cmd_worker+0xc0/0x498 [mac802154] process_one_work+0x334/0x8b8 ... Allocated by task 630: kasan_save_stack+0x2c/0x58 kasan_save_track+0x20/0x40 kasan_save_alloc_info+0x40/0x58 __kasan_kmalloc+0xa0/0xb8 __kvmalloc_node_noprof+0x1e8/0x588 alloc_netdev_mqs+0x74/0x7f0 ieee802154_if_add+0xac/0x630 [mac802154] ieee802154_register_hw+0x31c/0x3d0 [mac802154] fakelb_add_one+0x250/0x318 [fakelb] ... Freed by task 652: kasan_save_stack+0x2c/0x58 kasan_save_track+0x20/0x40 kasan_save_free_info+0x4c/0x78 __kasan_slab_free+0x60/0x90 kfree+0x194/0x478 kvfree+0x44/0x60 netdev_release+0x4c/0x68 device_release+0xac/0x130 kobject_cleanup+0x84/0x248 kobject_put+0x98/0xf8 netdev_run_todo+0x3a0/0x5e0 rtnl_unlock+0x18/0x30 ieee802154_unregister_hw+0x48/0x90 [mac802154] fakelb_remove+0xe8/0x148 [fakelb] Hold the receiving netdev from before a descriptor is queued until the descriptor is released. Since sdata is the netdev's private data, this also keeps sdata valid while a worker or scan cleanup accesses the descriptor. Fixes: 57588c71177f ("mac802154: Handle passive scanning") Fixes: d021d218f6d9 ("mac802154: Handle received BEACON_REQ") Cc: stable@vger.kernel.org Signed-off-by: Xuanqiang Luo Reviewed-by: Miquel Raynal --- include/net/cfg802154.h | 2 ++ net/mac802154/rx.c | 4 ++++ net/mac802154/scan.c | 1 + 3 files changed, 7 insertions(+) diff --git a/include/net/cfg802154.h b/include/net/cfg802154.h index 76d2cd2e2b309..57343762d7f0b 100644 --- a/include/net/cfg802154.h +++ b/include/net/cfg802154.h @@ -369,6 +369,7 @@ struct cfg802154_beacon_request { * @node: MAC packets to process list member * @skb: the received sk_buff * @sdata: the interface on which @skb was received + * @dev_tracker: netdev reference held until the descriptor is released * @page: page configuration when @skb was received * @channel: channel configuration when @skb was received */ @@ -376,6 +377,7 @@ struct cfg802154_mac_pkt { struct list_head node; struct sk_buff *skb; struct ieee802154_sub_if_data *sdata; + netdevice_tracker dev_tracker; u8 page; u8 channel; }; diff --git a/net/mac802154/rx.c b/net/mac802154/rx.c index 26da20ea470ef..df2f6128ddd4a 100644 --- a/net/mac802154/rx.c +++ b/net/mac802154/rx.c @@ -62,6 +62,7 @@ void mac802154_rx_beacon_worker(struct work_struct *work) mac802154_process_beacon(local, mac_pkt->skb, mac_pkt->page, mac_pkt->cha= nnel); =20 kfree_skb(mac_pkt->skb); + netdev_put(mac_pkt->sdata->dev, &mac_pkt->dev_tracker); kfree(mac_pkt); } =20 @@ -141,6 +142,7 @@ void mac802154_rx_mac_cmd_worker(struct work_struct *wo= rk) =20 out: kfree_skb(mac_pkt->skb); + netdev_put(mac_pkt->sdata->dev, &mac_pkt->dev_tracker); kfree(mac_pkt); } =20 @@ -237,6 +239,7 @@ ieee802154_subif_frame(struct ieee802154_sub_if_data *s= data, mac_pkt->sdata =3D sdata; mac_pkt->page =3D sdata->local->scan_page; mac_pkt->channel =3D sdata->local->scan_channel; + netdev_hold(sdata->dev, &mac_pkt->dev_tracker, GFP_ATOMIC); spin_lock_bh(&sdata->local->rx_lists_lock); list_add_tail(&mac_pkt->node, &sdata->local->rx_beacon_list); queue_work(sdata->local->mac_wq, &sdata->local->rx_beacon_work); @@ -251,6 +254,7 @@ ieee802154_subif_frame(struct ieee802154_sub_if_data *s= data, =20 mac_pkt->skb =3D skb_get(skb); mac_pkt->sdata =3D sdata; + netdev_hold(sdata->dev, &mac_pkt->dev_tracker, GFP_ATOMIC); spin_lock_bh(&sdata->local->rx_lists_lock); list_add_tail(&mac_pkt->node, &sdata->local->rx_mac_cmd_list); queue_work(sdata->local->mac_wq, &sdata->local->rx_mac_cmd_work); diff --git a/net/mac802154/scan.c b/net/mac802154/scan.c index 5fa98e001a8fb..c3c61ebde1568 100644 --- a/net/mac802154/scan.c +++ b/net/mac802154/scan.c @@ -114,6 +114,7 @@ static void mac802154_flush_queued_beacons(struct ieee8= 02154_local *local) list_for_each_entry_safe(mac_pkt, tmp, &mac_pkt_list, node) { list_del(&mac_pkt->node); kfree_skb(mac_pkt->skb); + netdev_put(mac_pkt->sdata->dev, &mac_pkt->dev_tracker); kfree(mac_pkt); } } --=20 2.43.0