osmocom-net-gprs November 2024

osmocom-net-gprs@lists.osmocom.org

3 participants
3 discussions

[syzbot] [net?] possible deadlock in gtp_encap_enable_socket
by syzbot 13 May '25

13 May '25

Hello, syzbot found the following issue on: HEAD commit: 9410645520e9 Merge tag 'net-next-6.12' of git://git.kernel.. git tree: net-next console+strace: https://syzkaller.appspot.com/x/log.txt?x=15d39e9f980000 kernel config: https://syzkaller.appspot.com/x/.config?x=37c006d80708398d dashboard link: https://syzkaller.appspot.com/bug?extid=e953a8f3071f5c0a28fd compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16215ca9980000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=110c6c27980000 Downloadable assets: disk image: https://storage.googleapis.com/syzbot-assets/80466d230dfb/disk-94106455.raw… vmlinux: https://storage.googleapis.com/syzbot-assets/ba253eabab42/vmlinux-94106455.… kernel image: https://storage.googleapis.com/syzbot-assets/569982fb6c88/bzImage-94106455.… IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+e953a8f3071f5c0a28fd(a)syzkaller.appspotmail.com IPVS: Unknown mcast interface: macvlan0 netlink: 8 bytes leftover after parsing attributes in process `syz-executor297'. netlink: 24 bytes leftover after parsing attributes in process `syz-executor297'. ====================================================== WARNING: possible circular locking dependency detected 6.11.0-syzkaller-01458-g9410645520e9 #0 Not tainted ------------------------------------------------------ syz-executor297/5243 is trying to acquire lock: ffff88801cf99158 (sk_lock-AF_INET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1609 [inline] ffff88801cf99158 (sk_lock-AF_INET){+.+.}-{0:0}, at: gtp_encap_enable_socket+0x2ce/0x5c0 drivers/net/gtp.c:1674 but task is already holding lock: ffffffff8fc88588 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:79 [inline] ffffffff8fc88588 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x6e6/0xcf0 net/core/rtnetlink.c:6643 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #2 (rtnl_mutex){+.+.}-{3:3}: lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5759 __mutex_lock_common kernel/locking/mutex.c:608 [inline] __mutex_lock+0x136/0xd70 kernel/locking/mutex.c:752 start_sync_thread+0xdc/0x2dc0 net/netfilter/ipvs/ip_vs_sync.c:1761 do_ip_vs_set_ctl+0x442/0x13d0 net/netfilter/ipvs/ip_vs_ctl.c:2732 nf_setsockopt+0x295/0x2c0 net/netfilter/nf_sockopt.c:101 smc_setsockopt+0x275/0xe50 net/smc/af_smc.c:3064 do_sock_setsockopt+0x3af/0x720 net/socket.c:2330 __sys_setsockopt+0x1ae/0x250 net/socket.c:2353 __do_sys_setsockopt net/socket.c:2362 [inline] __se_sys_setsockopt net/socket.c:2359 [inline] __x64_sys_setsockopt+0xb5/0xd0 net/socket.c:2359 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f -> #1 (&smc->clcsock_release_lock){+.+.}-{3:3}: lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5759 __mutex_lock_common kernel/locking/mutex.c:608 [inline] __mutex_lock+0x136/0xd70 kernel/locking/mutex.c:752 smc_switch_to_fallback+0x35/0xdb0 net/smc/af_smc.c:902 smc_sendmsg+0x11f/0x530 net/smc/af_smc.c:2771 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x221/0x270 net/socket.c:745 ____sys_sendmsg+0x525/0x7d0 net/socket.c:2603 ___sys_sendmsg net/socket.c:2657 [inline] __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2686 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f -> #0 (sk_lock-AF_INET){+.+.}-{0:0}: check_prev_add kernel/locking/lockdep.c:3133 [inline] check_prevs_add kernel/locking/lockdep.c:3252 [inline] validate_chain+0x18e0/0x5900 kernel/locking/lockdep.c:3868 __lock_acquire+0x137a/0x2040 kernel/locking/lockdep.c:5142 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5759 lock_sock_nested+0x48/0x100 net/core/sock.c:3611 lock_sock include/net/sock.h:1609 [inline] gtp_encap_enable_socket+0x2ce/0x5c0 drivers/net/gtp.c:1674 gtp_encap_enable drivers/net/gtp.c:1707 [inline] gtp_newlink+0x589/0xf30 drivers/net/gtp.c:1511 rtnl_newlink_create net/core/rtnetlink.c:3510 [inline] __rtnl_newlink net/core/rtnetlink.c:3730 [inline] rtnl_newlink+0x1591/0x20a0 net/core/rtnetlink.c:3743 rtnetlink_rcv_msg+0x73f/0xcf0 net/core/rtnetlink.c:6646 netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2550 netlink_unicast_kernel net/netlink/af_netlink.c:1331 [inline] netlink_unicast+0x7f6/0x990 net/netlink/af_netlink.c:1357 netlink_sendmsg+0x8e4/0xcb0 net/netlink/af_netlink.c:1901 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x221/0x270 net/socket.c:745 ____sys_sendmsg+0x525/0x7d0 net/socket.c:2603 ___sys_sendmsg net/socket.c:2657 [inline] __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2686 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f other info that might help us debug this: Chain exists of: sk_lock-AF_INET --> &smc->clcsock_release_lock --> rtnl_mutex Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(rtnl_mutex); lock(&smc->clcsock_release_lock); lock(rtnl_mutex); lock(sk_lock-AF_INET); *** DEADLOCK *** 1 lock held by syz-executor297/5243: #0: ffffffff8fc88588 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:79 [inline] #0: ffffffff8fc88588 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x6e6/0xcf0 net/core/rtnetlink.c:6643 stack backtrace: CPU: 0 UID: 0 PID: 5243 Comm: syz-executor297 Not tainted 6.11.0-syzkaller-01458-g9410645520e9 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:93 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119 check_noncircular+0x36a/0x4a0 kernel/locking/lockdep.c:2186 check_prev_add kernel/locking/lockdep.c:3133 [inline] check_prevs_add kernel/locking/lockdep.c:3252 [inline] validate_chain+0x18e0/0x5900 kernel/locking/lockdep.c:3868 __lock_acquire+0x137a/0x2040 kernel/locking/lockdep.c:5142 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5759 lock_sock_nested+0x48/0x100 net/core/sock.c:3611 lock_sock include/net/sock.h:1609 [inline] gtp_encap_enable_socket+0x2ce/0x5c0 drivers/net/gtp.c:1674 gtp_encap_enable drivers/net/gtp.c:1707 [inline] gtp_newlink+0x589/0xf30 drivers/net/gtp.c:1511 rtnl_newlink_create net/core/rtnetlink.c:3510 [inline] __rtnl_newlink net/core/rtnetlink.c:3730 [inline] rtnl_newlink+0x1591/0x20a0 net/core/rtnetlink.c:3743 rtnetlink_rcv_msg+0x73f/0xcf0 net/core/rtnetlink.c:6646 netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2550 netlink_unicast_kernel net/netlink/af_netlink.c:1331 [inline] netlink_unicast+0x7f6/0x990 net/netlink/af_netlink.c:1357 netlink_sendmsg+0x8e4/0xcb0 net/netlink/af_netlink.c:1901 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x221/0x270 net/socket.c:745 ____sys_sendmsg+0x525/0x7d0 net/socket.c:2603 ___sys_sendmsg net/socket.c:2657 [inline] __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2686 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fed198844a9 Code: 48 83 c4 28 c3 e8 37 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RS --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller(a)googlegroups.com. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. If the report is already addressed, let syzbot know by replying with: #syz fix: exact-commit-title If you want syzbot to run the reproducer, reply with: #syz test: git://repo/address.git branch-or-commit-hash If you attach or paste a git patch, syzbot will apply it before testing. If you want to overwrite report's subsystems, reply with: #syz set subsystems: new-subsystem (See the list of subsystem names on the web dashboard) If the report is a duplicate of another one, reply with: #syz dup: exact-subject-of-another-report If you want to undo deduplication, reply with: #syz undup

3 3

[PATCH net-next v4 0/5] net: Improve netns handling in RTNL and ip_tunnel
by Xiao Liang 21 Nov '24

21 Nov '24

This patch series includes some netns-related improvements and fixes for RTNL and ip_tunnel, to make link creation more intuitive: - Creating link in another net namespace doesn't conflict with link names in current one. - Refector rtnetlink link creation. Create link in target namespace directly. Pass both source and link netns to drivers via newlink() callback. So that # ip link add netns ns1 link-netns ns2 tun0 type gre ... will create tun0 in ns1, rather than create it in ns2 and move to ns1. And don't conflict with another interface named "tun0" in current netns. --- v4: - Pack newlink() parameters to a single struct. - Use ynl async_msg_queue.empty() in selftest. v3: link: https://lore.kernel.org/all/20241113125715.150201-1-shaw.leon@gmail.com/ - Drop "netns_atomic" flag and module parameter. Add netns parameter to newlink() instead, and convert drivers accordingly. - Move python NetNSEnter helper to net selftest lib. v2: link: https://lore.kernel.org/all/20241107133004.7469-1-shaw.leon@gmail.com/ - Check NLM_F_EXCL to ensure only link creation is affected. - Add self tests for link name/ifindex conflict and notifications in different netns. - Changes in dummy driver and ynl in order to add the test case. v1: link: https://lore.kernel.org/all/20241023023146.372653-1-shaw.leon@gmail.com/ Xiao Liang (5): net: ip_tunnel: Build flow in underlay net namespace rtnetlink: Lookup device in target netns when creating link rtnetlink: Decouple net namespaces in rtnl_newlink_create() selftests: net: Add python context manager for netns entering selftests: net: Add two test cases for link netns drivers/infiniband/ulp/ipoib/ipoib_netlink.c | 11 ++++-- drivers/net/amt.c | 13 ++++--- drivers/net/bareudp.c | 11 ++++-- drivers/net/bonding/bond_netlink.c | 8 ++-- drivers/net/can/dev/netlink.c | 4 +- drivers/net/can/vxcan.c | 11 ++++-- .../ethernet/qualcomm/rmnet/rmnet_config.c | 11 ++++-- drivers/net/geneve.c | 11 ++++-- drivers/net/gtp.c | 9 +++-- drivers/net/ipvlan/ipvlan.h | 4 +- drivers/net/ipvlan/ipvlan_main.c | 11 ++++-- drivers/net/ipvlan/ipvtap.c | 7 ++-- drivers/net/macsec.c | 11 ++++-- drivers/net/macvlan.c | 8 ++-- drivers/net/macvtap.c | 8 ++-- drivers/net/netkit.c | 11 ++++-- drivers/net/pfcp.c | 8 ++-- drivers/net/ppp/ppp_generic.c | 10 +++-- drivers/net/team/team_core.c | 7 ++-- drivers/net/veth.c | 11 ++++-- drivers/net/vrf.c | 7 ++-- drivers/net/vxlan/vxlan_core.c | 11 ++++-- drivers/net/wireguard/device.c | 8 ++-- drivers/net/wireless/virtual/virt_wifi.c | 10 +++-- drivers/net/wwan/wwan_core.c | 15 +++++-- include/net/ip_tunnels.h | 5 ++- include/net/rtnetlink.h | 34 +++++++++++++--- net/8021q/vlan_netlink.c | 11 ++++-- net/batman-adv/soft-interface.c | 8 ++-- net/bridge/br_netlink.c | 8 ++-- net/caif/chnl_net.c | 6 +-- net/core/rtnetlink.c | 29 +++++++++----- net/hsr/hsr_netlink.c | 14 ++++--- net/ieee802154/6lowpan/core.c | 9 +++-- net/ipv4/ip_gre.c | 27 ++++++++----- net/ipv4/ip_tunnel.c | 16 ++++---- net/ipv4/ip_vti.c | 10 +++-- net/ipv4/ipip.c | 10 +++-- net/ipv6/ip6_gre.c | 28 +++++++------ net/ipv6/ip6_tunnel.c | 16 ++++---- net/ipv6/ip6_vti.c | 15 ++++--- net/ipv6/sit.c | 16 ++++---- net/xfrm/xfrm_interface_core.c | 14 +++---- tools/testing/selftests/net/Makefile | 1 + .../testing/selftests/net/lib/py/__init__.py | 2 +- tools/testing/selftests/net/lib/py/netns.py | 18 +++++++++ tools/testing/selftests/net/netns-name.sh | 10 +++++ tools/testing/selftests/net/netns_atomic.py | 39 +++++++++++++++++++ 48 files changed, 377 insertions(+), 205 deletions(-) create mode 100755 tools/testing/selftests/net/netns_atomic.py -- 2.47.0

3 7

[PATCH net-next v3 0/6] net: Improve netns handling in RTNL and ip_tunnel
by Xiao Liang 16 Nov '24

16 Nov '24

This patch series includes some netns-related improvements and fixes for RTNL and ip_tunnel, to make link creation more intuitive: - Creating link in another net namespace doesn't conflict with link names in current one. - Refector rtnetlink link creation. Create link in target namespace directly. Pass both source and link netns to drivers via newlink() callback. So that # ip link add netns ns1 link-netns ns2 tun0 type gre ... will create tun0 in ns1, rather than create it in ns2 and move to ns1. And don't conflict with another interface named "tun0" in current netns. Patch 1 from Donald is included just as a dependency. --- v3: - Drop "netns_atomic" flag and module parameter. Add netns parameter to newlink() instead, and convert drivers accordingly. - Move python NetNSEnter helper to net selftest lib. v2: link: https://lore.kernel.org/all/20241107133004.7469-1-shaw.leon@gmail.com/ - Check NLM_F_EXCL to ensure only link creation is affected. - Add self tests for link name/ifindex conflict and notifications in different netns. - Changes in dummy driver and ynl in order to add the test case. v1: link: https://lore.kernel.org/all/20241023023146.372653-1-shaw.leon@gmail.com/ Donald Hunter (1): Revert "tools/net/ynl: improve async notification handling" Xiao Liang (5): net: ip_tunnel: Build flow in underlay net namespace rtnetlink: Lookup device in target netns when creating link rtnetlink: Decouple net namespaces in rtnl_newlink_create() selftests: net: Add python context manager for netns entering selftests: net: Add two test cases for link netns drivers/infiniband/ulp/ipoib/ipoib_netlink.c | 6 ++- drivers/net/amt.c | 6 +-- drivers/net/bareudp.c | 4 +- drivers/net/bonding/bond_netlink.c | 3 +- drivers/net/can/dev/netlink.c | 2 +- drivers/net/can/vxcan.c | 4 +- .../ethernet/qualcomm/rmnet/rmnet_config.c | 5 +- drivers/net/geneve.c | 4 +- drivers/net/gtp.c | 4 +- drivers/net/ipvlan/ipvlan.h | 2 +- drivers/net/ipvlan/ipvlan_main.c | 5 +- drivers/net/ipvlan/ipvtap.c | 4 +- drivers/net/macsec.c | 5 +- drivers/net/macvlan.c | 5 +- drivers/net/macvtap.c | 5 +- drivers/net/netkit.c | 4 +- drivers/net/pfcp.c | 4 +- drivers/net/ppp/ppp_generic.c | 4 +- drivers/net/team/team_core.c | 2 +- drivers/net/veth.c | 4 +- drivers/net/vrf.c | 2 +- drivers/net/vxlan/vxlan_core.c | 4 +- drivers/net/wireguard/device.c | 4 +- drivers/net/wireless/virtual/virt_wifi.c | 5 +- drivers/net/wwan/wwan_core.c | 6 ++- include/net/ip_tunnels.h | 5 +- include/net/rtnetlink.h | 22 ++++++++- net/8021q/vlan_netlink.c | 5 +- net/batman-adv/soft-interface.c | 5 +- net/bridge/br_netlink.c | 2 +- net/caif/chnl_net.c | 2 +- net/core/rtnetlink.c | 25 ++++++---- net/hsr/hsr_netlink.c | 8 +-- net/ieee802154/6lowpan/core.c | 5 +- net/ipv4/ip_gre.c | 13 +++-- net/ipv4/ip_tunnel.c | 16 +++--- net/ipv4/ip_vti.c | 5 +- net/ipv4/ipip.c | 5 +- net/ipv6/ip6_gre.c | 17 ++++--- net/ipv6/ip6_tunnel.c | 11 ++--- net/ipv6/ip6_vti.c | 11 ++--- net/ipv6/sit.c | 11 ++--- net/xfrm/xfrm_interface_core.c | 13 +++-- tools/net/ynl/cli.py | 10 ++-- tools/net/ynl/lib/ynl.py | 49 ++++++++----------- tools/testing/selftests/net/Makefile | 1 + .../testing/selftests/net/lib/py/__init__.py | 2 +- tools/testing/selftests/net/lib/py/netns.py | 18 +++++++ tools/testing/selftests/net/netns-name.sh | 10 ++++ tools/testing/selftests/net/netns_atomic.py | 38 ++++++++++++++ 50 files changed, 255 insertions(+), 157 deletions(-) create mode 100755 tools/testing/selftests/net/netns_atomic.py -- 2.47.0

2 7

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

osmocom-net-gprs November 2024