linux-kernel - Re: [PATCH] can: mcp251xfd: fix UAF from workqueue double-destroy

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20260108-quoll-of-exotic-vitality-a7ceaa-mkl@pengutronix.de>
Date: Thu, 8 Jan 2026 10:41:31 +0100
From: Marc Kleine-Budde <mkl@...gutronix.de>
To: Kery Qi <qikeyu2017@...il.com>
Cc: linux-kernel@...r.kernel.org, linux-can@...r.kernel.org
Subject: Re: [PATCH] can: mcp251xfd: fix UAF from workqueue double-destroy

On 08.01.2026 16:20:42, Kery Qi wrote:
> mcp251xfd_open() allocates priv->wq after the controller is started.
> If request_threaded_irq() or mcp251xfd_chip_interrupts_enable() fails,
> the error path destroys the workqueue but leaves priv->wq unchanged.
>
> This leaves a dangling non-NULL pointer that can later be destroyed
> again, for example:
> - a retry to open the device fails before priv->wq is reallocated and a
>   later close/remove cleanup destroys the stale pointer; or

Can you point me to the exact code path.

> - reset/recovery paths end up calling mcp251xfd_stop() after the failed
>   open and destroy priv->wq again.

mcp251xfd_stop() is only called from net_device_ops:

| static const struct net_device_ops mcp251xfd_netdev_ops = {
| 	.ndo_stop = mcp251xfd_stop,
| }

Is this ndo_stop is called if ndo_open failed?

> Clear priv->wq after destroy_workqueue() to make teardown idempotent and
> avoid double-destroy/use-after-free crashes.
>
> This is the same bug class as CVE-2024-26802 (stmmac workqueue teardown).

regards,
Marc

-- 
Pengutronix e.K.                 | Marc Kleine-Budde          |
Embedded Linux                   | https://www.pengutronix.de |
Vertretung Nürnberg              | Phone: +49-5121-206917-129 |
Amtsgericht Hildesheim, HRA 2686 | Fax:   +49-5121-206917-9   |

Download attachment "signature.asc" of type "application/pgp-signature" (489 bytes)