Re: [PATCH net v2] mac802154: lock rx_mac_cmd_list and drain it before freeing sdata
From: Jakub Kicinski <kuba@kernel.org>
Date: 2026-07-24 21:58:39
Also in:
lkml, stable
On Wed, 22 Jul 2026 12:16:08 +0200 Ibrahim Hashimov wrote:
rx_mac_cmd_list has no locking. The RX softirq producer in ieee802154_subif_frame() list_add_tail()s while the mac_wq worker list_del()s, and the worker dereferences mac_pkt->sdata with no liveness check.
Both sashikos complain about races: https://sashiko.dev/#/patchset/20260722101608.37744-1-security@auditcode.ai https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260722101608.37744-1-security@auditcode.ai