Re: [PATCH net v1] bpf: cpumap: fix use-after-free of dev_rx on netdev unregister

[Alexei Starovoitov]

On Sun, Sep 20, 2026 at 09:30 PM Jiayuan Chen <jiayuan.chen@xxxxxxxxx> wrote:
> So do what the softnet backlog does and use the netdev notifier:
>
> 1. On NETDEV_UNREGISTER, take the ring size and ask the kthread to
>    consume that many frames, or until the ring is empty. After that,
>    every frame that was in the ring has been handled by the stack or
>    dropped. The device is closed, so no new frames for it can show up.

That's not what the backlog does. flush_backlog() unlinks only the skbs
with skb->dev->reg_state == NETREG_UNREGISTERING and frees them.
It doesn't feed them to the stack, doesn't touch packets of other
devices, and flush_all_backlogs() runs once per
unregister_netdevice_many(), not once per device.

> @@ -528,6 +576,11 @@ static void __cpu_map_entry_free(struct work_struct *work)
>  	 */
>  	rcpu = container_of(to_rcu_work(work), struct bpf_cpu_map_entry, free_work);
>
> +	/* Unlink first, so the notifier can't wait on a kthread we stop */
> 
+	mutex_lock(&cpu_map_mutex);
> +	list_del(&rcpu->list);
> +	mutex_unlock(&cpu_map_mutex);
> +
>  	/* kthread_stop will wake_up_process and wait for it to complete.

After list_del() the ring still has frames and the kthread has to be
scheduled to consume them. kthread_stop() only wakes it up. When the
device is unregistered in that window the notifier doesn't see the
entry, doesn't wait, the netdev is freed and the kthread hits the same
eth_type_trans() UAF.

pw-bot: cr