Re: ieee802154: mcr20a/mrf24j40/at86rf230: unbind while the SPI completion chain is in flight operates on freed driver data (use-after-free, three same-shaped drivers)

[Miquel Raynal]

Hi,

On 22/10/2026 at 16:57:00 +08, 徐晗翔 <xuhx@xxxxxxxxxxx> wrote:

> Unbinding (or rmmod-ing, or hot-unplugging) any of the three in-tree
> ieee802154 SPI transceiver drivers while their IRQ-driven completion
> chain is in flight leaves the chain running on freed memory: the async
> SPI messages and their completion context are owned by the controller
> queue, but the callbacks only hold bare pointers to the driver private
> data and regmap, so after remove() frees the private data (and devres
> later frees the regmap), the still-queued chain steps read and write
> freed memory and even derive new spi_async() submissions from the freed
> spi_device -- a use-after-free family confirmed with KASAN on mainline
> 7.3 (42 reports in one unbind, three-stack closure probe/unbind/kworker;
> clean unbind when the chain happens to be idle).

This is indeed possible, even though not a huge deal since SPI devices
are by nature not hot-pluggable and the two other operations require
to be root.

You can send patches if you want to see these fixed.

Thanks,
Miquèl