diff options
| author | Chenguang Zhao <zhaochenguang@kylinos.cn> | 2026-07-23 17:26:37 +0800 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2026-07-27 17:52:50 -0700 |
| commit | 22666ba1420164753d7b0f5a841986b25ace5435 (patch) | |
| tree | 8c250ea86237bec95ca750ee7fb956b000ca79d5 /include/linux/timerqueue_types.h | |
| parent | 5546da86894d5906f131b05890705a7abf949d84 (diff) | |
forcedeth: fix UAF of txrx_stats in nv_remove
nv_remove() frees the per-CPU txrx_stats before unregister_netdev().
Until unregister completes, ndo_get_stats64, the NAPI/xmit data path,
and nv_close()/drain may still access txrx_stats, leading to a
use-after-free.
Free the stats only after unregister_netdev().
Fixes: f4b633b911fd ("forcedeth: use per cpu to collect xmit/recv statistics")
Signed-off-by: Chenguang Zhao <zhaochenguang@kylinos.cn>
Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev>
Link: https://patch.msgid.link/20260723092637.2135095-1-chenguang.zhao@linux.dev
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'include/linux/timerqueue_types.h')
0 files changed, 0 insertions, 0 deletions