[BUG] mac802154: KASAN slab-use-after-free in mac802154_rx_mac_cmd_worker

Hi Kernel Maintainers,

I hit the following report while testing current upstream kernel:

KASAN: slab-use-after-free in mac802154_rx_mac_cmd_worker

on commit: fce2dfa773ced15f27dd27cd0b482a7473cdcf2a (Jul 16 2026)

To help trigger the bug more reliably, we applied a minimal diagnostic patch
that only adds delays and print statements.

The reproducer and .config files are here.
https://gist.github.com/shuangpengbai/ea5e98e729d2ae8cb1e9481b5c315ab8

I'm happy to test debug patches or provide additional information.

Reported-by: Shuangpeng Bai <redacted>

[  376.015401][   T12] BUG: KASAN: slab-use-after-free in mac802154_rx_mac_cmd_worker (net/mac802154/rx.c:110)
[  376.016760][   T12] Read of size 4 at addr ffff888115e78b58 by task kworker/u8:0/12
[  376.017796][   T12]
[  376.018231][   T12] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  376.018237][   T12] Workqueue: phy1-mac-cmds mac802154_rx_mac_cmd_worker
[  376.018270][   T12] Call Trace:
[  376.018292][   T12]  <TASK>
[  376.018302][   T12]  dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)
[  376.018393][   T12]  print_report (mm/kasan/report.c:378 mm/kasan/report.c:482)
[  376.018529][   T12]  kasan_report (mm/kasan/report.c:595)
[  376.018543][   T12]  mac802154_rx_mac_cmd_worker (net/mac802154/rx.c:110)
[  376.018560][   T12]  process_scheduled_works (kernel/workqueue.c:3322 kernel/workqueue.c:3405)
[  376.018589][   T12]  worker_thread (kernel/workqueue.c:3486)
[  376.018599][   T12]  kthread (kernel/kthread.c:436)
[  376.018647][   T12]  ret_from_fork (archkernel/process.c:158)
[  376.018735][   T12]  ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
[  376.018754][   T12]  </TASK>
[  376.018758][   T12]
[  376.032833][   T12] Freed by task 8455 on cpu 0 at 375.611793s:
[  376.033290][   T12]  kasan_save_track (mm/kasan/common.c:57 mm/kasan/common.c:78)
[  376.033651][   T12]  kasan_save_free_info (mm/kasan/generic.c:584)
[  376.034018][   T12]  __kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285)
[  376.034371][   T12]  kfree (./include/linux/kasan.h:235 mm/slub.c:2705 mm/slub.c:6405 mm/slub.c:6720)
[  376.034677][   T12]  device_release (drivers/gpu/drm/vkms/vkms_configfs.c:690)
[  376.035065][   T12]  kobject_put (lib/kobject.c:689 lib/kobject.c:720 ./include/linux/kref.h:65 lib/kobject.c:737)
[  376.035413][   T12]  netdev_run_todo (net/core/dev.c:11749)
[  376.035808][   T12]  genl_family_rcv_msg_doit (net/netlink/genetlink.c:1117)
[  376.036235][   T12]  genl_rcv_msg (net/netlink/genetlink.c:1194 net/netlink/genetlink.c:1209)
[  376.036574][   T12]  netlink_rcv_skb (net/netlink/af_netlink.c:2556)
[  376.036933][   T12]  genl_rcv (net/netlink/genetlink.c:1218)
[  376.037233][   T12]  netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1345)
[  376.037584][   T12]  netlink_sendmsg (net/netlink/af_netlink.c:1900)
[  376.037930][   T12]  __sock_sendmsg (net/socket.c:775 net/socket.c:790)
[  376.038335][   T12]  __sys_sendto (net/socket.c:2252)
[  376.038676][   T12]  __x64_sys_sendto (net/socket.c:2259 net/socket.c:2255 net/socket.c:2255)
[  376.039018][   T12]  do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
[  376.039455][   T12]  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
[  376.039998][   T12]
[  376.040171][   T12] The buggy address belongs to the object at ffff888115e78000
[  376.040171][   T12]  which belongs to the cache kmalloc-cg-8k of size 8192
[  376.041250][   T12] The buggy address is located 2904 bytes inside of
[  376.041250][   T12]  freed 8192-byte region [ffff888115e78000, ffff888115e7a000)
[  376.042239][   T12]
[  376.042414][   T12] The buggy address belongs to the physical page:


Best,
Shuangpeng