Re: [PATCH net] net: nexthop: fix percpu use-after-free in remove_nh_grp_entry

[Eric Dumazet]

On Sat, Mar 7, 2026 at 12:39 AM Mehul Rao <mehulrao@xxxxxxxxx> wrote:
>
> When removing a nexthop from a group, remove_nh_grp_entry() publishes
> the new group via rcu_assign_pointer() then immediately frees the
> removed entry's percpu stats with free_percpu(). However, the
> synchronize_net() grace period in the caller remove_nexthop_from_groups()
> runs after the free. RCU readers that entered before the publish still
> see the old group and can dereference the freed stats via
> nh_grp_entry_stats_inc() -> get_cpu_ptr(nhge->stats), causing a
> use-after-free on percpu memory.
>
> Fix by deferring the free_percpu() until after synchronize_net() in the
> caller. Removed entries are chained via nh_list onto a local deferred
> free list. After the grace period completes and all RCU readers have
> finished, the percpu stats are safely freed.
>
> Fixes: f4676ea74b85 ("net: nexthop: Add nexthop group entry stats")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Mehul Rao <mehulrao@xxxxxxxxx>

SGTM, thanks !

Reviewed-by: Eric Dumazet <edumazet@xxxxxxxxxx>