[PATCH net] forcedeth: fix UAF of txrx_stats in nv_remove

[PATCH net] forcedeth: fix UAF of txrx_stats in nv_remove

[Chenguang Zhao]

From: Chenguang Zhao <zhaochenguang@kylinos.cn>

nv_remove() frees the per-CPU txrx_stats before unregister_netdev().
Until unregister completes, ndo_get_stats64, the NAPI/xmit data path,
and nv_close()/drain may still access txrx_stats, leading to a
use-after-free.

Free the stats only after unregister_netdev().

Fixes: f4b633b911fd ("forcedeth: use per cpu to collect xmit/recv statistics")
Signed-off-by: Chenguang Zhao <zhaochenguang@kylinos.cn>
---
 drivers/net/ethernet/nvidia/forcedeth.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/nvidia/forcedeth.c b/drivers/net/ethernet/nvidia/forcedeth.c
index 5b0435d7bc39..106885bd0f6b 100644
--- a/drivers/net/ethernet/nvidia/forcedeth.c
+++ b/drivers/net/ethernet/nvidia/forcedeth.c
@@ -6187,9 +6187,11 @@ static void nv_remove(struct pci_dev *pci_dev)
 	struct net_device *dev = pci_get_drvdata(pci_dev);
 	struct fe_priv *np = netdev_priv(dev);
 
-	free_percpu(np->txrx_stats);
-
+	/* txrx_stats is used by ndo_get_stats64 and the data path until
+	 * unregister_netdevice() has completed.
+	 */
 	unregister_netdev(dev);
+	free_percpu(np->txrx_stats);
 
 	nv_restore_mac_addr(pci_dev);
 
-- 
2.25.1

Re: [PATCH net] forcedeth: fix UAF of txrx_stats in nv_remove

[Vadim Fedorenko]

On 23/07/2026 10:26, Chenguang Zhao wrote:
> From: Chenguang Zhao <zhaochenguang@kylinos.cn>
> 
> nv_remove() frees the per-CPU txrx_stats before unregister_netdev().
> Until unregister completes, ndo_get_stats64, the NAPI/xmit data path,
> and nv_close()/drain may still access txrx_stats, leading to a
> use-after-free.
> 
> Free the stats only after unregister_netdev().
> 
> Fixes: f4b633b911fd ("forcedeth: use per cpu to collect xmit/recv statistics")
> Signed-off-by: Chenguang Zhao <zhaochenguang@kylinos.cn>
> ---
>   drivers/net/ethernet/nvidia/forcedeth.c | 6 ++++--
>   1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/net/ethernet/nvidia/forcedeth.c b/drivers/net/ethernet/nvidia/forcedeth.c
> index 5b0435d7bc39..106885bd0f6b 100644
> --- a/drivers/net/ethernet/nvidia/forcedeth.c
> +++ b/drivers/net/ethernet/nvidia/forcedeth.c
> @@ -6187,9 +6187,11 @@ static void nv_remove(struct pci_dev *pci_dev)
>   	struct net_device *dev = pci_get_drvdata(pci_dev);
>   	struct fe_priv *np = netdev_priv(dev);
>   
> -	free_percpu(np->txrx_stats);
> -
> +	/* txrx_stats is used by ndo_get_stats64 and the data path until
> +	 * unregister_netdevice() has completed.
> +	 */
>   	unregister_netdev(dev);
> +	free_percpu(np->txrx_stats);
>   
>   	nv_restore_mac_addr(pci_dev);
>   
Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>