Re: [PATCH net] forcedeth: fix UAF of txrx_stats in nv_remove
From: Jakub Kicinski <kuba@kernel.org>
Date: 2026-07-28 00:53:20
On Thu, 23 Jul 2026 17:26:37 +0800 Chenguang Zhao wrote:
quoted hunk ↗ jump to hunk
From: Chenguang Zhao <redacted> nv_remove() frees the per-CPU txrx_stats before unregister_netdev(). Until unregister completes, ndo_get_stats64, the NAPI/xmit data path, and nv_close()/drain may still access txrx_stats, leading to a use-after-free. Free the stats only after unregister_netdev(). Fixes: f4b633b911fd ("forcedeth: use per cpu to collect xmit/recv statistics") Signed-off-by: Chenguang Zhao <redacted> --- drivers/net/ethernet/nvidia/forcedeth.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)diff --git a/drivers/net/ethernet/nvidia/forcedeth.c b/drivers/net/ethernet/nvidia/forcedeth.c index 5b0435d7bc39..106885bd0f6b 100644 --- a/drivers/net/ethernet/nvidia/forcedeth.c +++ b/drivers/net/ethernet/nvidia/forcedeth.c@@ -6187,9 +6187,11 @@ static void nv_remove(struct pci_dev *pci_dev) struct net_device *dev = pci_get_drvdata(pci_dev); struct fe_priv *np = netdev_priv(dev); - free_percpu(np->txrx_stats); - + /* txrx_stats is used by ndo_get_stats64 and the data path until + * unregister_netdevice() has completed. + */
Applied, but without this stupid comment and preserving the original spacing.
unregister_netdev(dev); + free_percpu(np->txrx_stats); nv_restore_mac_addr(pci_dev);