Hello David, On 09/07/2026 at 23:18:58 +01, David Carlier <[email protected]> wrote:
> hwsim_update_pib() does an unserialized read-swap-free of phy->pib: > > pib_old = rtnl_dereference(phy->pib); > ... > rcu_assign_pointer(phy->pib, pib); > kfree_rcu(pib_old, rcu); > > It assumes the RTNL is held, but ->set_channel is not always called > under it: the mac802154 scan worker changes channels via > drv_set_channel() without the RTNL. Such an update can race an > RTNL-held one on the same phy; both read the same pib_old and both > kfree_rcu() it, double-freeing the object. With SLUB percpu sheaves > batching kfree_rcu(), this surfaces as a KASAN invalid-free in > rcu_free_sheaf(). > > struct hwsim_phy has no lock for pib. Add one and make the swap atomic > with rcu_replace_pointer() under it, dropping the misleading > rtnl_dereference(). > > Reported-by: [email protected] > Closes: https://syzkaller.appspot.com/bug?extid=60332fd095f8bb2946ad > Fixes: f25da51fdc38 ("ieee802154: hwsim: add replacement for fakelb") > Signed-off-by: David Carlier <[email protected]> > Cc: <[email protected]> Thank you for the patch, but I think Yousef already provided a similar patch: https://lore.kernel.org/all/[email protected]/ Yousef, can you confirm you will send v2 soon? Thanks, Miquèl
