Chenguang ZhaoandJakub Kicinski 22666ba142 forcedeth: fix UAF of txrx_stats in nv_remove ...

nv_remove() frees the per-CPU txrx_stats before unregister_netdev().
Until unregister completes, ndo_get_stats64, the NAPI/xmit data path,
and nv_close()/drain may still access txrx_stats, leading to a
use-after-free.

Free the stats only after unregister_netdev().

Fixes: f4b633b911 ("forcedeth: use per cpu to collect xmit/recv statistics")
Signed-off-by: Chenguang Zhao <zhaochenguang@kylinos.cn>
Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev>
Link: https://patch.msgid.link/20260723092637.2135095-1-chenguang.zhao@linux.dev
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

2026-07-27 17:52:50 -07:00

..

forcedeth.c

forcedeth: fix UAF of txrx_stats in nv_remove

2026-07-27 17:52:50 -07:00

Kconfig

…

Makefile

…