Hi, > In mana_remove(), unregister_netdevice() unlists the device but does not > synchronously wait for existing RCU grace periods to finish.
I will leave this ordering unchanged in v8. The premise does not match the unregister path in the target tree. unregister_netdevice() uses the NULL-head path, which performs unregister work immediately. Before returning, that path unlists the device and calls synchronize_net(), removes its sysfs exposure, and performs another network grace period. mana_free_queue_stats() runs after that call. Some final netdev processing is deferred to netdev_run_todo(), but the grace periods relevant to the identified proc/sysfs readers are not all deferred until rtnl_unlock(). The same ordering is present in the v6 counterpart and both upstream bases. The reported reader/free interleaving therefore does not establish a UAF requiring a statistics-lifetime change. Thanks, Wei
