Re: [PATCH] can: mcp251xfd: fix UAF from workqueue double-destroy

[Marc Kleine-Budde]

On 08.01.2026 16:20:42, Kery Qi wrote:
> mcp251xfd_open() allocates priv->wq after the controller is started.
> If request_threaded_irq() or mcp251xfd_chip_interrupts_enable() fails,
> the error path destroys the workqueue but leaves priv->wq unchanged.
>
> This leaves a dangling non-NULL pointer that can later be destroyed
> again, for example:
> - a retry to open the device fails before priv->wq is reallocated and a
>   later close/remove cleanup destroys the stale pointer; or

Can you point me to the exact code path.

> - reset/recovery paths end up calling mcp251xfd_stop() after the failed
>   open and destroy priv->wq again.

mcp251xfd_stop() is only called from net_device_ops:

| static const struct net_device_ops mcp251xfd_netdev_ops = {
| 	.ndo_stop = mcp251xfd_stop,
| }

Is this ndo_stop is called if ndo_open failed?

> Clear priv->wq after destroy_workqueue() to make teardown idempotent and
> avoid double-destroy/use-after-free crashes.
>
> This is the same bug class as CVE-2024-26802 (stmmac workqueue teardown).

regards,
Marc

-- 
Pengutronix e.K.                 | Marc Kleine-Budde          |
Embedded Linux                   | https://www.pengutronix.de |
Vertretung Nürnberg              | Phone: +49-5121-206917-129 |
Amtsgericht Hildesheim, HRA 2686 | Fax:   +49-5121-206917-9   |

Attachment: signature.asc
Description: PGP signature