Yes. I'll send v2 of my teardown patch with rcu_access_pointer(). It is separate from David's patch: mine moves the final PIB free after unregister, while David's serializes concurrent runtime PIB replacements. I don't think his patch is superseded by mine.
Thanks, Yousef On Mon, 13 Jul 2026 18:59:38 +0200, Miquel Raynal <[email protected]> wrote: > Hello David, > > On 09/07/2026 at 23:18:58 +01, David Carlier <[email protected]> wrote: > > > hwsim_update_pib() does an unserialized read-swap-free of phy->pib: > > > > pib_old = rtnl_dereference(phy->pib); > > ... > > rcu_assign_pointer(phy->pib, pib); > > kfree_rcu(pib_old, rcu); > > > > It assumes the RTNL is held, but ->set_channel is not always called > > under it: the mac802154 scan worker changes channels via > > drv_set_channel() without the RTNL. Such an update can race an > > RTNL-held one on the same phy; both read the same pib_old and both > > kfree_rcu() it, double-freeing the object. With SLUB percpu sheaves > > batching kfree_rcu(), this surfaces as a KASAN invalid-free in > > rcu_free_sheaf(). > > > > struct hwsim_phy has no lock for pib. Add one and make the swap atomic > > with rcu_replace_pointer() under it, dropping the misleading > > rtnl_dereference(). > > > > Reported-by: [email protected] > > Closes: https://syzkaller.appspot.com/bug?extid=60332fd095f8bb2946ad > > Fixes: f25da51fdc38 ("ieee802154: hwsim: add replacement for fakelb") > > Signed-off-by: David Carlier <[email protected]> > > Cc: <[email protected]> > > Thank you for the patch, but I think Yousef already provided a similar > patch: > > https://lore.kernel.org/all/[email protected]/ > > Yousef, can you confirm you will send v2 soon? > > Thanks, > Miquèl
