Re: [PATCH net] net: nexthop: fix percpu use-after-free in remove_nh_grp_entry

[Ido Schimmel]

On Fri, Mar 06, 2026 at 06:38:20PM -0500, Mehul Rao wrote:
> When removing a nexthop from a group, remove_nh_grp_entry() publishes
> the new group via rcu_assign_pointer() then immediately frees the
> removed entry's percpu stats with free_percpu(). However, the
> synchronize_net() grace period in the caller remove_nexthop_from_groups()
> runs after the free. RCU readers that entered before the publish still
> see the old group and can dereference the freed stats via
> nh_grp_entry_stats_inc() -> get_cpu_ptr(nhge->stats), causing a
> use-after-free on percpu memory.
> 
> Fix by deferring the free_percpu() until after synchronize_net() in the
> caller. Removed entries are chained via nh_list onto a local deferred
> free list. After the grace period completes and all RCU readers have
> finished, the percpu stats are safely freed.
> 
> Fixes: f4676ea74b85 ("net: nexthop: Add nexthop group entry stats")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Mehul Rao <mehulrao@xxxxxxxxx>

Reviewed-by: Ido Schimmel <idosch@xxxxxxxxxx>

Do you have a reproducer? I would like to understand why we don't see it
in the torture tests (e.g., ipv4_torture) in fib_nexthops.sh.