Re: [PATCH] ieee802154: hwsim: serialize pib updates to fix double-free

[Yousef Alhouseen]

Yes. I'll send v2 of my teardown patch with rcu_access_pointer(). It
is separate from David's patch: mine moves the final PIB free after
unregister, while David's serializes concurrent runtime PIB
replacements. I don't think his patch is superseded by mine.

Thanks,
Yousef

On Mon, 13 Jul 2026 18:59:38 +0200, Miquel Raynal
<miquel.raynal@xxxxxxxxxxx> wrote:
> Hello David,
>
> On 09/07/2026 at 23:18:58 +01, David Carlier <devnexen@xxxxxxxxx> wrote:
>
> > hwsim_update_pib() does an unserialized read-swap-free of phy->pib:
> >
> > pib_old = rtnl_dereference(phy->pib);
> > ...
> > rcu_assign_pointer(phy->pib, pib);
> > kfree_rcu(pib_old, rcu);
> >
> > It assumes the RTNL is held, but ->set_channel is not always called
> > under it: the mac802154 scan worker changes channels via
> > drv_set_channel() without the RTNL. Such an update can race an
> > RTNL-held one on the same phy; both read the same pib_old and both
> > kfree_rcu() it, double-freeing the object. With SLUB percpu sheaves
> > batching kfree_rcu(), this surfaces as a KASAN invalid-free in
> > rcu_free_sheaf().
> >
> > struct hwsim_phy has no lock for pib. Add one and make the swap atomic
> > with rcu_replace_pointer() under it, dropping the misleading
> > rtnl_dereference().
> >
> > Reported-by: syzbot+60332fd095f8bb2946ad@xxxxxxxxxxxxxxxxxxxxxxxxx
> > Closes: https://syzkaller.appspot.com/bug?extid=60332fd095f8bb2946ad
> > Fixes: f25da51fdc38 ("ieee802154: hwsim: add replacement for fakelb")
> > Signed-off-by: David Carlier <devnexen@xxxxxxxxx>
> > Cc: <stable@xxxxxxxxxxxxxxx>
>
> Thank you for the patch, but I think Yousef already provided a similar
> patch:
>
> https://lore.kernel.org/all/20260627235805.17310-1-alhouseenyousef@xxxxxxxxx/
>
> Yousef, can you confirm you will send v2 soon?
>
> Thanks,
> Miquèl