osmocom-net-gprs

osmocom-net-gprs@lists.osmocom.org

2 participants
527 discussions

[RFC] gtp: add 5G PDU Session Container (QFI) support?
by Anil Kaushik 03 Oct '26

03 Oct '26

Hi Pablo, Harald, The in-tree GTP driver supports GTPv0 and GTPv1-U, but has no handling for the 5G N3 PDU Session Container (PSC) extension header (type 0x85, 3GPP TS 29.281 / TS 38.415) that carries the QoS Flow Identifier (QFI). drivers/net/gtp.c also still has the "TODO: Support for extension header, sequence number and N-PDU" on the xmit path. I'd like to add PSC/QFI support, but before writing the datapath code I wanted to check two things with you. 1) Is this something you'd welcome in mainline gtp.c? I'm aware a lot of 5G user-plane work lives in out-of-tree datapaths (gtp5g, the eBPF eUPF), so I don't want to add datapath complexity you'd rather not carry here. 2) If yes: on RX, once the QFI has been parsed out of the PSC, what would you like the driver to do with it? The options I see are: - stash it in skb->mark, so tc/nftables can classify uplink traffic by QoS flow; - attach it as skb metadata (tc_skb_ext / metadata_dst); or - just validate it and otherwise ignore it. The shape of the RX patch depends on this, so I'd rather ask than guess. The plan would be a small incremental series: 1. add a GTPA_QFI (u8) netlink attribute + ynl spec, stored per PDP context (control-plane plumbing only); 2. RX: parse the PSC extension header and extract the QFI; 3. TX: build the PSC from the per-PDP QFI on the downlink path (the existing extension-header TODO). Patch 1 is already written and builds; I'll post the series once I know whether you want it in mainline and how you'd prefer the RX QFI to be surfaced. Happy to adjust the approach. Thanks, Anil

2 2

[RFC net-next] netlink: specs: add genetlink-legacy spec for GTP
by Anil Kaushik 01 Oct '26

01 Oct '26

The GTP (GPRS Tunnelling Protocol, user plane) generic netlink family has no YAML specification under Documentation/netlink/specs/, so it cannot be consumed by the ynl tooling used for user-space clients, documentation and selftests. Add a genetlink-legacy spec describing the existing family: the PDP context management commands (NEWPDP, DELPDP, GETPDP) and the GTP-U echo request (ECHOREQ), the GTPA_* attribute set, and the "gtp" multicast group. The spec is derived directly from include/uapi/linux/gtp.h and the gtp_genl_policy / gtp_genl_ops tables in drivers/net/gtp.c; command and attribute values match the existing uapi one-to-one. This only adds the description; there is no kernel code or uapi change. Signed-off-by: Anil Kaushik <anilkaushikwireless(a)gmail.com> --- Documentation/netlink/specs/gtp.yaml | 170 +++++++++++++++++++++++++++ MAINTAINERS | 1 + 2 files changed, 171 insertions(+) create mode 100644 Documentation/netlink/specs/gtp.yaml diff --git a/Documentation/netlink/specs/gtp.yaml b/Documentation/netlink/specs/gtp.yaml new file mode 100644 index 000000000..7193f5e53 --- /dev/null +++ b/Documentation/netlink/specs/gtp.yaml @@ -0,0 +1,170 @@ +# SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-3-Clause) +--- +name: gtp + +protocol: genetlink-legacy + +doc: | + GPRS Tunnelling Protocol, user plane (GTP-U). + + The gtp netdevice encapsulates and decapsulates user plane packets in + GTP-U tunnels (GTPv0 and GTPv1-U, see 3GPP TS 29.060 and TS 29.281). + This family manages the PDP contexts that describe the tunnels and + triggers GTP-U echo requests. It is driven by user space control planes + such as those built on libgtpnl. + +kernel-policy: global + +attribute-sets: + - + name: gtp + name-prefix: gtpa- + attributes: + - + name: link + type: u32 + doc: ifindex of the gtp netdevice the context is attached to. + - + name: version + type: u32 + doc: GTP version of the context, 0 for GTPv0 or 1 for GTPv1-U. + - + name: tid + type: u64 + doc: Tunnel identifier, GTPv0 only. + - + name: peer-address + type: u32 + byte-order: big-endian + display-hint: ipv4 + doc: | + IPv4 address of the remote GSN peer (GGSN or SGSN). Also known + as GTPA_SGSN_ADDRESS, kept for legacy user space. + - + name: ms-address + type: u32 + byte-order: big-endian + display-hint: ipv4 + doc: IPv4 address of the mobile subscriber served by the context. + - + name: flow + type: u16 + doc: Flow label, GTPv0 only. + - + name: net-ns-fd + type: u32 + doc: File descriptor of the network namespace of the gtp netdevice. + - + name: i-tei + type: u32 + doc: Ingress Tunnel Endpoint Identifier, GTPv1-U only. + - + name: o-tei + type: u32 + doc: Egress Tunnel Endpoint Identifier, GTPv1-U only. + - + name: pad + type: pad + - + name: peer-addr6 + type: binary + checks: + exact-len: 16 + byte-order: big-endian + display-hint: ipv6 + doc: IPv6 address of the remote GSN peer (GGSN or SGSN). + - + name: ms-addr6 + type: binary + checks: + exact-len: 16 + byte-order: big-endian + display-hint: ipv6 + doc: IPv6 address of the mobile subscriber served by the context. + - + name: family + type: u8 + doc: Address family (AF_INET or AF_INET6) of the context addresses. + +operations: + list: + - + name: newpdp + doc: Create or update a PDP context. + attribute-set: gtp + value: 0 + dont-validate: [strict, dump] + flags: [admin-perm] + do: + request: &pdp-attrs + attributes: + - link + - version + - tid + - peer-address + - peer-addr6 + - ms-address + - ms-addr6 + - flow + - i-tei + - o-tei + - family + - net-ns-fd + - + name: delpdp + doc: Delete a PDP context. + attribute-set: gtp + dont-validate: [strict, dump] + flags: [admin-perm] + do: + request: *pdp-attrs + - + name: getpdp + doc: Get or dump one or more PDP contexts. + attribute-set: gtp + dont-validate: [strict, dump] + flags: [admin-perm] + do: + request: + attributes: + - link + - version + - tid + - ms-address + - ms-addr6 + - i-tei + - family + - net-ns-fd + reply: &pdp-reply + attributes: + - version + - tid + - peer-address + - peer-addr6 + - ms-address + - ms-addr6 + - flow + - i-tei + - o-tei + - family + dump: + reply: *pdp-reply + - + name: echoreq + doc: Send a GTP-U echo request to a peer. + attribute-set: gtp + dont-validate: [strict, dump] + flags: [admin-perm] + do: + request: + attributes: + - link + - version + - peer-address + - peer-addr6 + - family + +mcast-groups: + list: + - + name: gtp diff --git a/MAINTAINERS b/MAINTAINERS index 51873349b..a6e43995e 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -11421,6 +11421,7 @@ M: Harald Welte <laforge(a)gnumonks.org> L: osmocom-net-gprs(a)lists.osmocom.org S: Maintained T: git git://git.kernel.org/pub/scm/linux/kernel/git/pablo/gtp.git +F: Documentation/netlink/specs/gtp.yaml F: drivers/net/gtp.c GUID PARTITION TABLE (GPT) -- 2.25.1

1 0

[PATCH net-next v2] gtp: fix repeated word 'to' in comment
by Hemanth Selam 09 Sep '26

09 Sep '26

Drop the second 'to', reported by checkpatch.pl as a possible repeated word. Only touches a comment, no code changes. Assisted-by: Cursor:claude-opus-5 Signed-off-by: Hemanth Selam <hemanth.selam(a)gmail.com> --- Notes: v2: designate the patch to net-next and use a subject prefix naming the component, as maintainer-netdev.rst asks; v1 went out with a bare [PATCH] and a "net:" prefix. Rebased onto net-next, diff unchanged. v1: https://lore.kernel.org/all/20260907063804.26581-1-hemanth.selam@gmail.com/ drivers/net/gtp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c index 69fe5717846b..4aff23bcfdd1 100644 --- a/drivers/net/gtp.c +++ b/drivers/net/gtp.c @@ -770,7 +770,7 @@ static int gtp_parse_exthdrs(struct sk_buff *skb, unsigned int *hdrlen) * * This length field includes length field size itself (1 byte), * payload (variable length) and next type (1 byte). The extension - * header is aligned to to 4 bytes. + * header is aligned to 4 bytes. */ do {

2 1

[PATCH] net: fix repeated word 'to' in comment
by Hemanth Selam 09 Sep '26

09 Sep '26

Drop the second 'to', reported by checkpatch.pl as a possible repeated word. Only touches a comment, no code changes. Assisted-by: Cursor:claude-opus-5 Signed-off-by: Hemanth Selam <hemanth.selam(a)gmail.com> --- drivers/net/gtp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c index 69fe5717846b..4aff23bcfdd1 100644 --- a/drivers/net/gtp.c +++ b/drivers/net/gtp.c @@ -770,7 +770,7 @@ static int gtp_parse_exthdrs(struct sk_buff *skb, unsigned int *hdrlen) * * This length field includes length field size itself (1 byte), * payload (variable length) and next type (1 byte). The extension - * header is aligned to to 4 bytes. + * header is aligned to 4 bytes. */ do { -- 2.48.1

3 3

[PATCH net v2 0/2] gtp: fix sk_created race conditions
by Cen Zhang (Microsoft) 26 Aug '26

26 Aug '26

Two races exist around the sk_created flag in the GTP driver: an initialization ordering issue where sk_created is published before the socket pointers are assigned, and a teardown lifetime issue where concurrent readers can still use the sockets after they are freed. They are split into separate patches because they require fundamentally different fixes -- memory barriers for ordering vs synchronize_net() and RTNL for lifetime. Changes since v1 [1]: - Use smp_store_release()/smp_load_acquire() for proper memory ordering as suggested by Simon Horman. - Add patch 2/2 to fix teardown races in gtp_encap_disable(): reorder to clear sk_created first, add synchronize_net() for softirq paths, and hold RTNL in gtp_genl_send_echo_req() for the process-context path that synchronize_net() cannot protect. Patch 1/2 fixes the initialization ordering race. Patch 2/2 fixes the teardown lifetime races (softirq + genl). [1] https://lore.kernel.org/netdev/20260816035205.57966-1-blbllhy@gmail.com/ Cen Zhang (Microsoft) (2): gtp: fix sk_created publication race in gtp_create_sockets() gtp: fix use-after-free during GTP device teardown drivers/net/gtp.c | 70 ++++++++++++++++++++++++++++++++++------------- 1 file changed, 51 insertions(+), 19 deletions(-) base-commit: b70b7b71561f2be1183b6046964d950c2b203bfc -- 2.55.0

2 3

[PATCH net v2] net: iptunnel: fix stale transport header during tunnel decapsulation
by Dong Chenchen 26 Aug '26

26 Aug '26

Syzbot reported a crash in qdisc_pkt_len_segs_init() caused by a stale transport_header offset after tunnel decapsulation. BUG: unable to handle page fault for address: ffffed102091a42e Oops: Oops: 0000 [#1] SMP KASAN NOPTI CPU: 0 UID: 0 PID: 340 Comm: qdisc_uaf_repro Not tainted 7.2.0-rc4-00061-g248951ddc14d #256 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:__asan_load2 <IRQ> qdisc_pkt_len_segs_init (net/core/dev.c:4145) __dev_queue_xmit (net/core/dev.c:4787) br_dev_queue_push_xmit (net/bridge/br_forward.c:53) br_handle_frame_finish (net/bridge/br_input.c:229) br_handle_frame (net/bridge/br_input.c:315) __netif_receive_skb_core.constprop.0 (net/core/dev.c:6099) __netif_receive_skb_list_core (net/core/dev.c:6287) netif_receive_skb_list_internal (net/core/dev.c:6445) napi_complete_done (net/core/dev.c:6813) gro_cell_poll (net/core/gro_cells.c:74) __napi_poll (net/core/dev.c:7735) net_rx_action (net/core/dev.c:7798 net/core/dev.c:7955) handle_softirqs (kernel/softirq.c:622) do_softirq (kernel/softirq.c:523 kernel/softirq.c:510 ) __local_bh_enable_ip (kernel/softirq.c:450) tun_get_user (drivers/net/tun.c:1986 (discriminator 1)) tun_chr_write_iter (drivers/net/tun.c:2032) The issue is completely latent until qdisc read transport header in commit 7fb4c1967011 ("net: pull headers in qdisc_pkt_len_segs_init()"). The crash requires four conditions to line up: 1. The incoming packet is encapsulated and carries GSO metadata. The outer transport header offset is stored in skb->transport_header while the packet is still in the outer tunnel context. 2. The tunnel receiver strips the outer headers. skb->data is advanced to the inner frame, but skb->transport_header is left pointing to the now-removed outer L4 header, so it becomes a negative offset relative to the new data. 3. The inner frame is not delivered to the local IP stack. Instead, it is forwarded at L2 by a bridge or HSR, so ip_rcv_core() never runs and the transport header is not reset to the inner L4 offset. 4. The forwarding path calls __dev_queue_xmit(), which enters qdisc_pkt_len_segs_init(). That function computes the GSO header length from skb_transport_offset(skb). Because the offset is negative, the unsigned cast overflows and pskb_may_pull(skb, hdr_len + sizeof(struct tcphdr)) reads past the end of the skb, triggering a KASAN fault or page fault. The issue specifically requires GSO packets (shinfo->gso_size != 0), which are processed/aggregated through gro_cells. Fix this by clearing transport_header to the ~0U sentinel in gro_cell for all tunnnel driver. GTP does not support GRO/GSO, drop the evil GSO packets in GTP directly. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+83181a31faf9455499c5(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/69de2bee.a00a0220.475f0.0041.GAE@google.com/T/ Suggested-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- drivers/net/gtp.c | 5 +++++ include/linux/skbuff.h | 5 +++++ net/core/gro_cells.c | 2 ++ 3 files changed, 12 insertions(+) diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c index 9a12cc53da00..fbf617b1acc9 100644 --- a/drivers/net/gtp.c +++ b/drivers/net/gtp.c @@ -312,6 +312,11 @@ static int gtp_inner_proto(struct sk_buff *skb, unsigned int hdrlen, static int gtp_rx(struct pdp_ctx *pctx, struct sk_buff *skb, unsigned int hdrlen, unsigned int role, __u16 inner_proto) { + if (skb_is_gso(skb)) { + netdev_dbg(pctx->dev, "GSO is not support in GTP\n"); + goto err; + } + if (!gtp_check_ms(skb, pctx, hdrlen, role, inner_proto)) { netdev_dbg(pctx->dev, "No PDP ctx for this MS\n"); return 1; diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h index 22eda1d54a0e..626bbb9bae1a 100644 --- a/include/linux/skbuff.h +++ b/include/linux/skbuff.h @@ -3082,6 +3082,11 @@ static inline bool skb_transport_header_was_set(const struct sk_buff *skb) return skb->transport_header != (typeof(skb->transport_header))~0U; } +static inline void skb_unset_transport_header(struct sk_buff *skb) +{ + skb->transport_header = (typeof(skb->transport_header))~0U; +} + static inline unsigned char *skb_transport_header(const struct sk_buff *skb) { DEBUG_NET_WARN_ON_ONCE(!skb_transport_header_was_set(skb)); diff --git a/net/core/gro_cells.c b/net/core/gro_cells.c index 1b84385c04bd..d8c0a2867120 100644 --- a/net/core/gro_cells.c +++ b/net/core/gro_cells.c @@ -22,6 +22,8 @@ int gro_cells_receive(struct gro_cells *gcells, struct sk_buff *skb) if (unlikely(!(dev->flags & IFF_UP))) goto drop; + skb_unset_transport_header(skb); + if (!gcells->cells || skb_cloned(skb) || netif_elide_gro(dev)) { res = netif_rx(skb); goto unlock; -- 2.25.1

4 3

[PATCH net] gtp: fix NULL pointer dereference in gtp0_handle_echo_resp()
by Cen Zhang (Microsoft) 25 Aug '26

25 Aug '26

In gtp_create_sockets(), gtp->sk_created is set to true before gtp->sk0 and gtp->sk1u are assigned. A concurrent GTP Echo Response packet on another CPU observes sk_created == true and dereferences the still-NULL gtp->sk0 in gtp0_handle_echo_resp(), causing a kernel panic. KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] RIP: 0010:gtp_encap_recv (drivers/net/gtp.c:542 gtp0_handle_echo_resp) Call Trace: <IRQ> udp_queue_rcv_one_skb ip_protocol_deliver_rcu ip_local_deliver Kernel panic - not syncing: Fatal exception in interrupt Reorder the assignments so that gtp->sk0 and gtp->sk1u are fully visible before gtp->sk_created is set to true. This ensures no concurrent packet path can observe the flag without valid socket pointers. Fixes: b20dc3c68458 ("gtp: Allow to create GTP device without FDs") Reported-by: AutonomousCodeSecurity(a)microsoft.com Reported-by: Xiang Mei (Microsoft) <xmei5(a)asu.edu> Reported-by: Cen Zhang (Microsoft) <blbllhy(a)gmail.com> Signed-off-by: Cen Zhang (Microsoft) <blbllhy(a)gmail.com> --- drivers/net/gtp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c index 9a12cc53da00..2b5a8f6d24d0 100644 --- a/drivers/net/gtp.c +++ b/drivers/net/gtp.c @@ -1456,9 +1456,9 @@ static int gtp_create_sockets(struct gtp_dev *gtp, const struct nlattr *nla, return PTR_ERR(sk1u); } - gtp->sk_created = true; gtp->sk0 = sk0; gtp->sk1u = sk1u; + gtp->sk_created = true; return 0; } -- 2.52.0

2 2

[PATCH net v2] gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free
by Cen Zhang (Microsoft) 24 Aug '26

24 Aug '26

gtp_newlink()'s error path frees tid_hash and addr_hash without waiting for an RCU grace period after clearing sk_user_data. A concurrent gtp_encap_recv() in softirq may still hold the gtp_dev pointer obtained via rcu_dereference_sk_user_data() and access the freed memory. BUG: KASAN: slab-use-after-free in gtp0_pdp_find+0x1f6/0x200 (gtp.c:152) Call Trace: <IRQ> gtp0_pdp_find+0x1f6/0x200 gtp_encap_recv+0x527/0x24b0 udp_queue_rcv_one_skb+0x75f/0xc10 Add synchronize_net() before the kfree calls in out_hashtable, which covers all error paths from both gtp_encap_enable() and gtp_create_sockets(). Fixes: 459aa660eb1d8ce6 ("gtp: add initial driver for datapath of GPRS Tunneling Protocol (GTP-U)") Reported-by: AutonomousCodeSecurity(a)microsoft.com Reported-by: Xiang Mei (Microsoft) <xmei5(a)asu.edu> Reported-by: Cen Zhang (Microsoft) <blbllhy(a)gmail.com> Signed-off-by: Cen Zhang (Microsoft) <blbllhy(a)gmail.com> --- v2: Add the net tree subject prefix. drivers/net/gtp.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c index 9a12cc53da00..f11bcc0c0ac4 100644 --- a/drivers/net/gtp.c +++ b/drivers/net/gtp.c @@ -1543,6 +1543,8 @@ static int gtp_newlink(struct net_device *dev, out_encap: gtp_encap_disable(gtp); out_hashtable: + /* Wait for RCU readers that may still reference this gtp_dev. */ + synchronize_net(); kfree(gtp->addr_hash); kfree(gtp->tid_hash); return err; -- 2.52.0

3 2

[PATCH net v5] gtp: serialize PDP context updates
by Qing Ming 22 Aug '26

22 Aug '26

PDP contexts can be deleted through GTP_CMD_DELPDP or while the GTP network device is being unregistered. The latter is serialized by RTNL, but the generic-netlink delete path only holds RCU. Running both paths concurrently can therefore make both paths delete the same PDP context. The issue was found through static analysis and reproduced on a KASAN-enabled kernel by a simple two-thread program racing GTP_CMD_DELPDP against RTM_DELLINK: Oops: general protection fault, probably for non-canonical address KASAN: maybe wild-memory-access in range [0xdead000000000120-0xdead000000000127] RIP: gtp_genl_del_pdp+0x1c1/0x420 [gtp] RBP: dead000000000122 The second deletion dereferenced the poisoned hlist pprev pointer. Serialize gtp_pdp_add(), gtp_genl_del_pdp(), and gtp_dellink() with a shared mutex. Keep the mutex held until the final use of a PDP context in the NEWPDP path, and keep the RCU read-side section around the complete PDP context use in the DELPDP path. Fixes: 459aa660eb1d ("gtp: add initial driver for datapath of GPRS Tunneling Protocol (GTP-U)") Cc: stable(a)vger.kernel.org Assisted-by: Codex:gpt-5 Signed-off-by: Qing Ming <a0yami(a)mailbox.org> --- v5: - Keep gtp_pdp_lock held through the final pctx use in the NEWPDP path. - Keep the RCU read-side section around the full pctx use in the DELPDP path. v4: https://lore.kernel.org/netdev/20260814031526.118216-1-a0yami@mailbox.org/ drivers/net/gtp.c | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-) diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c index 9a12cc53da00..2f6e77cce385 100644 --- a/drivers/net/gtp.c +++ b/drivers/net/gtp.c @@ -12,6 +12,7 @@ #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt #include <linux/module.h> +#include <linux/mutex.h> #include <linux/skbuff.h> #include <linux/udp.h> #include <linux/rculist.h> @@ -108,6 +109,7 @@ struct gtp_net { }; static u32 gtp_h_initval; +static DEFINE_MUTEX(gtp_pdp_lock); static struct genl_family gtp_genl_family; @@ -151,7 +153,8 @@ static struct pdp_ctx *gtp0_pdp_find(struct gtp_dev *gtp, u64 tid, u16 family) head = &gtp->tid_hash[gtp0_hashfn(tid) % gtp->hash_size]; - hlist_for_each_entry_rcu(pdp, head, hlist_tid) { + hlist_for_each_entry_rcu(pdp, head, hlist_tid, + lockdep_is_held(&gtp_pdp_lock)) { if (pdp->af == family && pdp->gtp_version == GTP_V0 && pdp->u.v0.tid == tid) @@ -168,7 +171,8 @@ static struct pdp_ctx *gtp1_pdp_find(struct gtp_dev *gtp, u32 tid, u16 family) head = &gtp->tid_hash[gtp1u_hashfn(tid) % gtp->hash_size]; - hlist_for_each_entry_rcu(pdp, head, hlist_tid) { + hlist_for_each_entry_rcu(pdp, head, hlist_tid, + lockdep_is_held(&gtp_pdp_lock)) { if (pdp->af == family && pdp->gtp_version == GTP_V1 && pdp->u.v1.i_tei == tid) @@ -185,7 +189,8 @@ static struct pdp_ctx *ipv4_pdp_find(struct gtp_dev *gtp, __be32 ms_addr) head = &gtp->addr_hash[ipv4_hashfn(ms_addr) % gtp->hash_size]; - hlist_for_each_entry_rcu(pdp, head, hlist_addr) { + hlist_for_each_entry_rcu(pdp, head, hlist_addr, + lockdep_is_held(&gtp_pdp_lock)) { if (pdp->af == AF_INET && pdp->ms.addr.s_addr == ms_addr) return pdp; @@ -220,7 +225,8 @@ static struct pdp_ctx *ipv6_pdp_find(struct gtp_dev *gtp, head = &gtp->addr_hash[ipv6_hashfn(ms_addr) % gtp->hash_size]; - hlist_for_each_entry_rcu(pdp, head, hlist_addr) { + hlist_for_each_entry_rcu(pdp, head, hlist_addr, + lockdep_is_held(&gtp_pdp_lock)) { if (pdp->af == AF_INET6 && ipv6_pdp_addr_equal(&pdp->ms.addr6, ms_addr)) return pdp; @@ -1555,9 +1561,11 @@ static void gtp_dellink(struct net_device *dev, struct list_head *head) struct pdp_ctx *pctx; int i; + mutex_lock(&gtp_pdp_lock); for (i = 0; i < gtp->hash_size; i++) hlist_for_each_entry_safe(pctx, next, &gtp->tid_hash[i], hlist_tid) pdp_context_delete(pctx); + mutex_unlock(&gtp_pdp_lock); list_del(&gtp->list); unregister_netdevice_queue(dev, head); @@ -2053,6 +2061,7 @@ static int gtp_genl_new_pdp(struct sk_buff *skb, struct genl_info *info) goto out_unlock; } + mutex_lock(&gtp_pdp_lock); pctx = gtp_pdp_add(gtp, sk, info); if (IS_ERR(pctx)) { err = PTR_ERR(pctx); @@ -2060,6 +2069,7 @@ static int gtp_genl_new_pdp(struct sk_buff *skb, struct genl_info *info) gtp_tunnel_notify(pctx, GTP_CMD_NEWPDP, GFP_KERNEL); err = 0; } + mutex_unlock(&gtp_pdp_lock); out_unlock: rtnl_unlock(); @@ -2134,6 +2144,8 @@ static int gtp_genl_del_pdp(struct sk_buff *skb, struct genl_info *info) if (!info->attrs[GTPA_VERSION]) return -EINVAL; + mutex_lock(&gtp_pdp_lock); + rcu_read_lock(); pctx = gtp_find_pdp(sock_net(skb->sk), info->attrs); @@ -2154,6 +2166,7 @@ static int gtp_genl_del_pdp(struct sk_buff *skb, struct genl_info *info) out_unlock: rcu_read_unlock(); + mutex_unlock(&gtp_pdp_lock); return err; } base-commit: a3dee9bb902ee4357fa02e49b415d7724ee0140a -- 2.53.0

2 1

[PATCH] gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free
by Cen Zhang (Microsoft) 19 Aug '26

19 Aug '26

gtp_newlink()'s error path frees tid_hash and addr_hash without waiting for an RCU grace period after clearing sk_user_data. A concurrent gtp_encap_recv() in softirq may still hold the gtp_dev pointer obtained via rcu_dereference_sk_user_data() and access the freed memory. BUG: KASAN: slab-use-after-free in gtp0_pdp_find+0x1f6/0x200 (gtp.c:152) Call Trace: <IRQ> gtp0_pdp_find+0x1f6/0x200 gtp_encap_recv+0x527/0x24b0 udp_queue_rcv_one_skb+0x75f/0xc10 Add synchronize_net() before the kfree calls in out_hashtable, which covers all error paths from both gtp_encap_enable() and gtp_create_sockets(). Fixes: 459aa660eb1d8ce6 ("gtp: add initial driver for datapath of GPRS Tunneling Protocol (GTP-U)") Reported-by: AutonomousCodeSecurity(a)microsoft.com Reported-by: Xiang Mei (Microsoft) <xmei5(a)asu.edu> Reported-by: Cen Zhang (Microsoft) <blbllhy(a)gmail.com> Signed-off-by: Cen Zhang (Microsoft) <blbllhy(a)gmail.com> --- drivers/net/gtp.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c index 9a12cc53da00..f11bcc0c0ac4 100644 --- a/drivers/net/gtp.c +++ b/drivers/net/gtp.c @@ -1543,6 +1543,8 @@ static int gtp_newlink(struct net_device *dev, out_encap: gtp_encap_disable(gtp); out_hashtable: + /* Wait for RCU readers that may still reference this gtp_dev. */ + synchronize_net(); kfree(gtp->addr_hash); kfree(gtp->tid_hash); return err; -- 2.52.0

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

osmocom-net-gprs