[PATCH] can: mcp251xfd: fix UAF from workqueue double-destroy

[Kery Qi]

mcp251xfd_open() allocates priv->wq after the controller is started.
If request_threaded_irq() or mcp251xfd_chip_interrupts_enable() fails,
the error path destroys the workqueue but leaves priv->wq unchanged.

This leaves a dangling non-NULL pointer that can later be destroyed
again, for example:
- a retry to open the device fails before priv->wq is reallocated and a
  later close/remove cleanup destroys the stale pointer; or
- reset/recovery paths end up calling mcp251xfd_stop() after the failed
  open and destroy priv->wq again.

Clear priv->wq after destroy_workqueue() to make teardown idempotent and
avoid double-destroy/use-after-free crashes.

This is the same bug class as CVE-2024-26802 (stmmac workqueue teardown).

Signed-off-by: Kery Qi <qikeyu2017@xxxxxxxxx>
---
 drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c b/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c
index 5134ebb85880..c5ac0c8a6e08 100644
--- a/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c
+++ b/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c
@@ -1661,6 +1661,8 @@ static int mcp251xfd_open(struct net_device *ndev)
 	free_irq(spi->irq, priv);
 out_destroy_workqueue:
 	destroy_workqueue(priv->wq);
+	if (priv->wq)
+		priv->wq = NULL;
 out_can_rx_offload_disable:
 	can_rx_offload_disable(&priv->offload);
 	set_bit(MCP251XFD_FLAGS_DOWN, priv->flags);
-- 
2.34.1