mirror of
https://github.com/torvalds/linux.git
synced 2026-07-27 01:32:21 +02:00
234e5e898b
mac802154_scan_worker() captures the scanning sub-interface under RCU
and then keeps dereferencing sdata->dev after rcu_read_unlock() and
outside the rtnl -- in the failure traces, in
mac802154_transmit_beacon_req() (skb->dev = sdata->dev), and in the
end_scan cleanup. Nothing keeps that netdev alive across the worker
iteration.
A concurrent DEL_INTERFACE or PHY removal can unregister the interface
once the worker drops the rtnl between its two drv_set_channel()
sections. unregister_netdevice() frees the netdev asynchronously from
netdev_run_todo() with the rtnl already dropped, so neither holding the
rtnl nor the per-PHY IEEE802154_IS_SCANNING flag prevents a stale worker
iteration from dereferencing the freed netdev -- a KASAN
slab-use-after-free, reachable by racing TRIGGER_SCAN against
DEL_INTERFACE (both CAP_NET_ADMIN).
Pin the netdev with netdev_hold() while the RCU read lock is still held,
and release it at every worker exit.
Fixes:
|
||
|---|---|---|
| .. | ||
| cfg.c | ||
| cfg.h | ||
| driver-ops.h | ||
| ieee802154_i.h | ||
| iface.c | ||
| Kconfig | ||
| llsec.c | ||
| llsec.h | ||
| mac_cmd.c | ||
| main.c | ||
| Makefile | ||
| mib.c | ||
| rx.c | ||
| scan.c | ||
| trace.c | ||
| trace.h | ||
| tx.c | ||
| util.c | ||