Re: [PATCH net v2] mac802154: remove interfaces with RCU list deletion

Kuniyuki Iwashima <[email protected]> Wed, 1 Jul 2026 14:49:47 -0700

Newsgroups	org.kernel.vger.linux-wpan,org.kernel.vger.linux-kernel,org.kernel.vger.netdev,org.kernel.vger.stable
Message-ID	<CAAVpQUCfzVMV4NZPnTGB7RFCxrBPHET0sxnAoO6zKuUNZaFTRg@mail.gmail.com>

On Wed, Jul 1, 2026 at 9:42=E2=80=AFAM Yousef Alhouseen
<[email protected]> wrote:
>
> Queue wake, stop, and disable paths walk local->interfaces under RCU.
> The bulk hardware teardown path removes entries with list_del(), so an
> asynchronous transmit completion can follow a poisoned list node in
> ieee802154_wake_queue().
>
> Use list_del_rcu() as in the single-interface removal path. The following
> unregister_netdevice() waits for in-flight RCU readers before freeing the
> netdevice, so no separate grace-period wait is needed.
>
> Fixes: 592dfbfc72f5 ("mac820154: move interface unregistration into iface=
")
> Reported-by: [email protected]
> Closes: https://syzkaller.appspot.com/bug?extid=3D36256deb69a588e9290e
> Cc: [email protected]
> Signed-off-by: Yousef Alhouseen <[email protected]>

Reviewed-by: Kuniyuki Iwashima <[email protected]>