linux-kernel - [PATCH] can: mcp251xfd: fix UAF from workqueue double-destroy

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20260108082042.1627-1-qikeyu2017@gmail.com>
Date: Thu,  8 Jan 2026 16:20:42 +0800
From: Kery Qi <qikeyu2017@...il.com>
To: mkl@...gutronix.de
Cc: linux-kernel@...r.kernel.org,
	Kery Qi <qikeyu2017@...il.com>
Subject: [PATCH] can: mcp251xfd: fix UAF from workqueue double-destroy

mcp251xfd_open() allocates priv->wq after the controller is started.
If request_threaded_irq() or mcp251xfd_chip_interrupts_enable() fails,
the error path destroys the workqueue but leaves priv->wq unchanged.

This leaves a dangling non-NULL pointer that can later be destroyed
again, for example:
- a retry to open the device fails before priv->wq is reallocated and a
  later close/remove cleanup destroys the stale pointer; or
- reset/recovery paths end up calling mcp251xfd_stop() after the failed
  open and destroy priv->wq again.

Clear priv->wq after destroy_workqueue() to make teardown idempotent and
avoid double-destroy/use-after-free crashes.

This is the same bug class as CVE-2024-26802 (stmmac workqueue teardown).

Signed-off-by: Kery Qi <qikeyu2017@...il.com>
---
 drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c b/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c
index 5134ebb85880..c5ac0c8a6e08 100644
--- a/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c
+++ b/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c
@@ -1661,6 +1661,8 @@ static int mcp251xfd_open(struct net_device *ndev)
 	free_irq(spi->irq, priv);
 out_destroy_workqueue:
 	destroy_workqueue(priv->wq);
+	if (priv->wq)
+		priv->wq = NULL;
 out_can_rx_offload_disable:
 	can_rx_offload_disable(&priv->offload);
 	set_bit(MCP251XFD_FLAGS_DOWN, priv->flags);
-- 
2.34.1