osmocom-net-gprs April 2025

osmocom-net-gprs@lists.osmocom.org

2 participants
2 discussions

[syzbot] [net?] possible deadlock in gtp_encap_enable_socket

by syzbot

Hello, syzbot found the following issue on: HEAD commit: 9410645520e9 Merge tag 'net-next-6.12' of git://git.kernel.. git tree: net-next console+strace: https://syzkaller.appspot.com/x/log.txt?x=15d39e9f980000 kernel config: https://syzkaller.appspot.com/x/.config?x=37c006d80708398d dashboard link: https://syzkaller.appspot.com/bug?extid=e953a8f3071f5c0a28fd compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16215ca9980000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=110c6c27980000 Downloadable assets: disk image: https://storage.googleapis.com/syzbot-assets/80466d230dfb/disk-94106455.raw… vmlinux: https://storage.googleapis.com/syzbot-assets/ba253eabab42/vmlinux-94106455.… kernel image: https://storage.googleapis.com/syzbot-assets/569982fb6c88/bzImage-94106455.… IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+e953a8f3071f5c0a28fd(a)syzkaller.appspotmail.com IPVS: Unknown mcast interface: macvlan0 netlink: 8 bytes leftover after parsing attributes in process `syz-executor297'. netlink: 24 bytes leftover after parsing attributes in process `syz-executor297'. ====================================================== WARNING: possible circular locking dependency detected 6.11.0-syzkaller-01458-g9410645520e9 #0 Not tainted ------------------------------------------------------ syz-executor297/5243 is trying to acquire lock: ffff88801cf99158 (sk_lock-AF_INET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1609 [inline] ffff88801cf99158 (sk_lock-AF_INET){+.+.}-{0:0}, at: gtp_encap_enable_socket+0x2ce/0x5c0 drivers/net/gtp.c:1674 but task is already holding lock: ffffffff8fc88588 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:79 [inline] ffffffff8fc88588 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x6e6/0xcf0 net/core/rtnetlink.c:6643 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #2 (rtnl_mutex){+.+.}-{3:3}: lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5759 __mutex_lock_common kernel/locking/mutex.c:608 [inline] __mutex_lock+0x136/0xd70 kernel/locking/mutex.c:752 start_sync_thread+0xdc/0x2dc0 net/netfilter/ipvs/ip_vs_sync.c:1761 do_ip_vs_set_ctl+0x442/0x13d0 net/netfilter/ipvs/ip_vs_ctl.c:2732 nf_setsockopt+0x295/0x2c0 net/netfilter/nf_sockopt.c:101 smc_setsockopt+0x275/0xe50 net/smc/af_smc.c:3064 do_sock_setsockopt+0x3af/0x720 net/socket.c:2330 __sys_setsockopt+0x1ae/0x250 net/socket.c:2353 __do_sys_setsockopt net/socket.c:2362 [inline] __se_sys_setsockopt net/socket.c:2359 [inline] __x64_sys_setsockopt+0xb5/0xd0 net/socket.c:2359 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f -> #1 (&smc->clcsock_release_lock){+.+.}-{3:3}: lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5759 __mutex_lock_common kernel/locking/mutex.c:608 [inline] __mutex_lock+0x136/0xd70 kernel/locking/mutex.c:752 smc_switch_to_fallback+0x35/0xdb0 net/smc/af_smc.c:902 smc_sendmsg+0x11f/0x530 net/smc/af_smc.c:2771 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x221/0x270 net/socket.c:745 ____sys_sendmsg+0x525/0x7d0 net/socket.c:2603 ___sys_sendmsg net/socket.c:2657 [inline] __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2686 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f -> #0 (sk_lock-AF_INET){+.+.}-{0:0}: check_prev_add kernel/locking/lockdep.c:3133 [inline] check_prevs_add kernel/locking/lockdep.c:3252 [inline] validate_chain+0x18e0/0x5900 kernel/locking/lockdep.c:3868 __lock_acquire+0x137a/0x2040 kernel/locking/lockdep.c:5142 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5759 lock_sock_nested+0x48/0x100 net/core/sock.c:3611 lock_sock include/net/sock.h:1609 [inline] gtp_encap_enable_socket+0x2ce/0x5c0 drivers/net/gtp.c:1674 gtp_encap_enable drivers/net/gtp.c:1707 [inline] gtp_newlink+0x589/0xf30 drivers/net/gtp.c:1511 rtnl_newlink_create net/core/rtnetlink.c:3510 [inline] __rtnl_newlink net/core/rtnetlink.c:3730 [inline] rtnl_newlink+0x1591/0x20a0 net/core/rtnetlink.c:3743 rtnetlink_rcv_msg+0x73f/0xcf0 net/core/rtnetlink.c:6646 netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2550 netlink_unicast_kernel net/netlink/af_netlink.c:1331 [inline] netlink_unicast+0x7f6/0x990 net/netlink/af_netlink.c:1357 netlink_sendmsg+0x8e4/0xcb0 net/netlink/af_netlink.c:1901 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x221/0x270 net/socket.c:745 ____sys_sendmsg+0x525/0x7d0 net/socket.c:2603 ___sys_sendmsg net/socket.c:2657 [inline] __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2686 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f other info that might help us debug this: Chain exists of: sk_lock-AF_INET --> &smc->clcsock_release_lock --> rtnl_mutex Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(rtnl_mutex); lock(&smc->clcsock_release_lock); lock(rtnl_mutex); lock(sk_lock-AF_INET); *** DEADLOCK *** 1 lock held by syz-executor297/5243: #0: ffffffff8fc88588 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:79 [inline] #0: ffffffff8fc88588 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x6e6/0xcf0 net/core/rtnetlink.c:6643 stack backtrace: CPU: 0 UID: 0 PID: 5243 Comm: syz-executor297 Not tainted 6.11.0-syzkaller-01458-g9410645520e9 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:93 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119 check_noncircular+0x36a/0x4a0 kernel/locking/lockdep.c:2186 check_prev_add kernel/locking/lockdep.c:3133 [inline] check_prevs_add kernel/locking/lockdep.c:3252 [inline] validate_chain+0x18e0/0x5900 kernel/locking/lockdep.c:3868 __lock_acquire+0x137a/0x2040 kernel/locking/lockdep.c:5142 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5759 lock_sock_nested+0x48/0x100 net/core/sock.c:3611 lock_sock include/net/sock.h:1609 [inline] gtp_encap_enable_socket+0x2ce/0x5c0 drivers/net/gtp.c:1674 gtp_encap_enable drivers/net/gtp.c:1707 [inline] gtp_newlink+0x589/0xf30 drivers/net/gtp.c:1511 rtnl_newlink_create net/core/rtnetlink.c:3510 [inline] __rtnl_newlink net/core/rtnetlink.c:3730 [inline] rtnl_newlink+0x1591/0x20a0 net/core/rtnetlink.c:3743 rtnetlink_rcv_msg+0x73f/0xcf0 net/core/rtnetlink.c:6646 netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2550 netlink_unicast_kernel net/netlink/af_netlink.c:1331 [inline] netlink_unicast+0x7f6/0x990 net/netlink/af_netlink.c:1357 netlink_sendmsg+0x8e4/0xcb0 net/netlink/af_netlink.c:1901 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x221/0x270 net/socket.c:745 ____sys_sendmsg+0x525/0x7d0 net/socket.c:2603 ___sys_sendmsg net/socket.c:2657 [inline] __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2686 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fed198844a9 Code: 48 83 c4 28 c3 e8 37 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RS --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller(a)googlegroups.com. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. If the report is already addressed, let syzbot know by replying with: #syz fix: exact-commit-title If you want syzbot to run the reproducer, reply with: #syz test: git://repo/address.git branch-or-commit-hash If you attach or paste a git patch, syzbot will apply it before testing. If you want to overwrite report's subsystems, reply with: #syz set subsystems: new-subsystem (See the list of subsystem names on the web dashboard) If the report is a duplicate of another one, reply with: #syz dup: exact-subject-of-another-report If you want to undo deduplication, reply with: #syz undup

1 month, 1 week

PGW stress test using OSMO-UECUPS and TTCN-3/PGW test suite

by boufaresimen1994＠gmail.com

Dear Osmocom Community, I hope this message finds you well. I am currently setting up a testing environment to evaluate the performance of my Packet Gateway (PGW) in terms of maximum simultaneous active sessions and bandwidth. The architecture of my test setup includes: VM osmo-ttcn3: Hosts the TTCN-3 framework, which initiates GTP-C session creation and integrates with the osmo-uecups solution to simulate user sessions by sending ICMP echo requests (pings) to public IP addresses (e.g., 8.8.8.8). VM osmo-uecups: Manages network namespaces (netns), each representing a simulated user session. VM pgw: My Packet Gateway, handling the routing and forwarding of packets between the simulated users and the external network via the GTP-U protocol. Issue Encountered: While using the TTCN-3/PGW test suite scripts that execute ping tests inside each created GTP tunnel, I observed the following on the osmo-uecups VM: ICMP echo requests are successfully sent from the netns and are visible in tcpdump captures both inside each netns and on the physical interfaces of the osmo-uecups VM. ICMP echo replies are sent back by my PGW for each UE session, and I can see them when capturing traces on the physical interface of the osmo-uecups VM. However, these ICMP echo replies are not injected into each netns. When capturing tcpdump inside each netns, I can see the ICMP echo requests but no corresponding replies. This behavior results in ping test failures in the TTCN-3 test suite, as the echo replies do not reach the originating netns. Additional Context: Initially, when running the test suite, I encountered the following error in the osmo-uecups-daemon logs: DEP NOTICE X.X.X.X:2152: Unexpected GTP Flags: 0x32 (gtp_endpoint.c:59) Upon investigation, I found that this was due to my PGW including a sequence number in the GTP-U header, resulting in a flag value of 0x32. To address this, I manually modified the gtp_endpoint.c file to accept this flag. After this adjustment, the "Unexpected GTP Flags: 0x32" message no longer appears. However, despite resolving this issue, the ping tests continue to fail because the ICMP echo replies are not being injected back into the respective netns. Additionally, I now receive the following message in the osmo-uecups-daemon log: DEP NOTICE X.X.X.X:2152: Short GTP Message: 98 < len=96 (gtp_endpoint.c:74) I would greatly appreciate any guidance or suggestions you can provide to help resolve this issue. Please find below the configuration changes I made in the gtp_endpoint.c file:: ************************************************************************************** /* check GTP header contents */ if (gtph->flags != 0x30 && gtph->flags != 0x32) { LOGEP(ep, LOGL_NOTICE, "Unexpected GTP Flags: 0x%02x\n", gtph->flags); continue; } ////////////////////////////// unsigned int hdr_len = sizeof(*gtph); if (gtph->flags & 0x02) { hdr_len += 2; // Si le flag Sequence est activé } /* Vérifie que la longueur totale attendue (header + payload) est présente */ if (hdr_len + ntohs(gtph->length) > nread) { LOGEP(ep, LOGL_NOTICE, "Shotr GTP Message: %u < len=%d\n", hdr_len + ntohs(gtph->length), nread); continue; } /* Transmission du payload au TUN device à partir de l'offset hdr_len */ rc = write(outfd, buffer+hdr_len, ntohs(gtph->length)); *********************************************************************************** Thank you for your time and assistance. Best regards, Imen Boufares

2 months

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

osmocom-net-gprs April 2025