Hello Ibrahim Hashimov.
On Sat, 25 Jul 2026 15:51:54 +0200, Ibrahim Hashimov wrote:
> The RX softirq producer ieee802154_subif_frame() queues received beacon
> and MAC-command frames onto local->rx_beacon_list / rx_mac_cmd_list and
> schedules a process-context worker, storing a raw mac_pkt->sdata (and
> skb->dev == sdata->dev) with neither a reference nor any locking:
>
> - the lists have no lock: the softirq producer list_add_tail()s while the
> mac_wq worker list_del()s, so sibling interfaces on the same phy corrupt
> the list;
>
> [...]
Applied to wpan/wpan.git, thanks!
[1/1] mac802154: fix use-after-free of sdata via queued RX frames
https://git.kernel.org/wpan/wpan/c/2f37fba846c9
regards,
Stefan Schmidt
