osmocom-net-gprs

osmocom-net-gprs@lists.osmocom.org

6 participants
480 discussions

[PATCH net 2/6] gtp: fix use-after-free in gtp_encap_destroy()

by Taehee Yoo

gtp_encap_destroy() is called twice. 1. When interface is deleted. 2. When udp socket is destroyed. either gtp->sk0 or gtp->sk1u could be freed by sock_put() in gtp_encap_destroy(). so, when gtp_encap_destroy() is called again, it would uses freed sk pointer. patch makes gtp_encap_destroy() to set either gtp->sk0 or gtp->sk1u to null. in addition, both gtp->sk0 and gtp->sk1u pointer are protected by rtnl_lock. so, rtnl_lock() is added. Test command: gtp-link add gtp1 & killall gtp-link ip link del gtp1 Splat looks like: [ 83.182767] BUG: KASAN: use-after-free in __lock_acquire+0x3a20/0x46a0 [ 83.184128] Read of size 8 at addr ffff8880cc7d5360 by task ip/1008 [ 83.185567] CPU: 1 PID: 1008 Comm: ip Not tainted 5.2.0-rc6+ #50 [ 83.188469] Call Trace: [ ... ] [ 83.200126] lock_acquire+0x141/0x380 [ 83.200575] ? lock_sock_nested+0x3a/0xf0 [ 83.201069] _raw_spin_lock_bh+0x38/0x70 [ 83.201551] ? lock_sock_nested+0x3a/0xf0 [ 83.202044] lock_sock_nested+0x3a/0xf0 [ 83.202520] gtp_encap_destroy+0x18/0xe0 [gtp] [ 83.203065] gtp_encap_disable.isra.14+0x13/0x50 [gtp] [ 83.203687] gtp_dellink+0x56/0x170 [gtp] [ 83.204190] rtnl_delete_link+0xb4/0x100 [ ... ] [ 83.236513] Allocated by task 976: [ 83.236925] save_stack+0x19/0x80 [ 83.237332] __kasan_kmalloc.constprop.3+0xa0/0xd0 [ 83.237894] kmem_cache_alloc+0xd8/0x280 [ 83.238360] sk_prot_alloc.isra.42+0x50/0x200 [ 83.238874] sk_alloc+0x32/0x940 [ 83.239264] inet_create+0x283/0xc20 [ 83.239684] __sock_create+0x2dd/0x540 [ 83.240136] __sys_socket+0xca/0x1a0 [ 83.240550] __x64_sys_socket+0x6f/0xb0 [ 83.240998] do_syscall_64+0x9c/0x450 [ 83.241466] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 83.242061] [ 83.242249] Freed by task 0: [ 83.242616] save_stack+0x19/0x80 [ 83.243013] __kasan_slab_free+0x111/0x150 [ 83.243498] kmem_cache_free+0x89/0x250 [ 83.244444] __sk_destruct+0x38f/0x5a0 [ 83.245366] rcu_core+0x7e9/0x1c20 [ 83.245766] __do_softirq+0x213/0x8fa Fixes: 1e3a3abd8b28 ("gtp: make GTP sockets in gtp_newlink optional") Signed-off-by: Taehee Yoo <ap420073(a)gmail.com> --- drivers/net/gtp.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c index 939da5442f65..5101f8c3c99c 100644 --- a/drivers/net/gtp.c +++ b/drivers/net/gtp.c @@ -285,13 +285,17 @@ static int gtp1u_udp_encap_recv(struct gtp_dev *gtp, struct sk_buff *skb) return gtp_rx(pctx, skb, hdrlen, gtp->role); } -static void gtp_encap_destroy(struct sock *sk) +static void __gtp_encap_destroy(struct sock *sk) { struct gtp_dev *gtp; lock_sock(sk); gtp = sk->sk_user_data; if (gtp) { + if (gtp->sk0 == sk) + gtp->sk0 = NULL; + else + gtp->sk1u = NULL; udp_sk(sk)->encap_type = 0; rcu_assign_sk_user_data(sk, NULL); sock_put(sk); @@ -299,12 +303,19 @@ static void gtp_encap_destroy(struct sock *sk) release_sock(sk); } +static void gtp_encap_destroy(struct sock *sk) +{ + rtnl_lock(); + __gtp_encap_destroy(sk); + rtnl_unlock(); +} + static void gtp_encap_disable_sock(struct sock *sk) { if (!sk) return; - gtp_encap_destroy(sk); + __gtp_encap_destroy(sk); } static void gtp_encap_disable(struct gtp_dev *gtp) @@ -1038,6 +1049,7 @@ static int gtp_genl_new_pdp(struct sk_buff *skb, struct genl_info *info) return -EINVAL; } + rtnl_lock(); rcu_read_lock(); gtp = gtp_find_dev(sock_net(skb->sk), info->attrs); @@ -1062,6 +1074,7 @@ static int gtp_genl_new_pdp(struct sk_buff *skb, struct genl_info *info) out_unlock: rcu_read_unlock(); + rtnl_unlock(); return err; } -- 2.17.1

5 years, 11 months

[PATCH net 1/6] gtp: fix suspicious RCU usage

by Taehee Yoo

gtp_encap_enable_socket() and gtp_encap_destroy() are not protected by rcu_read_lock(). and it's not safe to write sk->sk_user_data. This patch make these functions to use lock_sock() instead of rcu_dereference_sk_user_data(). Test commands: gtp-link add gtp1 Splat looks like: [ 83.238315] ============================= [ 83.239127] WARNING: suspicious RCU usage [ 83.239702] 5.2.0-rc6+ #49 Not tainted [ 83.240268] ----------------------------- [ 83.241205] drivers/net/gtp.c:799 suspicious rcu_dereference_check() usage! [ 83.243828] [ 83.243828] other info that might help us debug this: [ 83.243828] [ 83.246325] [ 83.246325] rcu_scheduler_active = 2, debug_locks = 1 [ 83.247314] 1 lock held by gtp-link/1008: [ 83.248523] #0: 0000000017772c7f (rtnl_mutex){+.+.}, at: __rtnl_newlink+0x5f5/0x11b0 [ 83.251503] [ 83.251503] stack backtrace: [ 83.252173] CPU: 0 PID: 1008 Comm: gtp-link Not tainted 5.2.0-rc6+ #49 [ 83.253271] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 [ 83.254562] Call Trace: [ 83.254995] dump_stack+0x7c/0xbb [ 83.255567] gtp_encap_enable_socket+0x2df/0x360 [gtp] [ 83.256415] ? gtp_find_dev+0x1a0/0x1a0 [gtp] [ 83.257161] ? memset+0x1f/0x40 [ 83.257843] gtp_newlink+0x90/0xa21 [gtp] [ 83.258497] ? __netlink_ns_capable+0xc3/0xf0 [ 83.259260] __rtnl_newlink+0xb9f/0x11b0 [ 83.260022] ? rtnl_link_unregister+0x230/0x230 [ ... ] Fixes: 1e3a3abd8b28 ("gtp: make GTP sockets in gtp_newlink optional") Signed-off-by: Taehee Yoo <ap420073(a)gmail.com> --- drivers/net/gtp.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c index fc45b749db46..939da5442f65 100644 --- a/drivers/net/gtp.c +++ b/drivers/net/gtp.c @@ -289,12 +289,14 @@ static void gtp_encap_destroy(struct sock *sk) { struct gtp_dev *gtp; - gtp = rcu_dereference_sk_user_data(sk); + lock_sock(sk); + gtp = sk->sk_user_data; if (gtp) { udp_sk(sk)->encap_type = 0; rcu_assign_sk_user_data(sk, NULL); sock_put(sk); } + release_sock(sk); } static void gtp_encap_disable_sock(struct sock *sk) @@ -796,7 +798,8 @@ static struct sock *gtp_encap_enable_socket(int fd, int type, goto out_sock; } - if (rcu_dereference_sk_user_data(sock->sk)) { + lock_sock(sock->sk); + if (sock->sk->sk_user_data) { sk = ERR_PTR(-EBUSY); goto out_sock; } @@ -812,6 +815,7 @@ static struct sock *gtp_encap_enable_socket(int fd, int type, setup_udp_tunnel_sock(sock_net(sock->sk), sock, &tuncfg); out_sock: + release_sock(sock->sk); sockfd_put(sock); return sk; } -- 2.17.1

5 years, 11 months

high ksoftirqd while using module gtp?

by Tony Clark

Dear All, I've been using the GTP-U kernel module to communicate with a P-GW. Running Fedora 29, kernel 4.18.16-300.fc29.x86_64. At high traffic levels through the GTP-U tunnel I see the performance degrade as 100% CPU is consumed by a single ksoftirqd process. It is running on a multi-cpu machine and as far as I can tell the load is evenly spread across the cpus (ie either manually via smp_affinity, or even irqbalance, checking /proc/interrupts so forth.). Has anyone else experienced this? Is there any particular area you could recommend I investigate to find the root cause of this bottleneck, as i'm starting to scratch my head where to look next... Thanks in advance Tony ---- FYI modinfo gtp filename: /lib/modules/4.18.16-300.fc29.x86_64/kernel/drivers/net/gtp.ko.xz alias: net-pf-16-proto-16-family-gtp alias: rtnl-link-gtp description: Interface driver for GTP encapsulated traffic author: Harald Welte <hwelte(a)sysmocom.de> license: GPL depends: udp_tunnel retpoline: Y intree: Y name: gtp vermagic: 4.18.16-300.fc29.x86_64 SMP mod_unload modinfo udp_tunnel filename: /lib/modules/4.18.16-300.fc29.x86_64/kernel/net/ipv4/udp_tunnel.ko.xz license: GPL depends: retpoline: Y intree: Y name: udp_tunnel vermagic: 4.18.16-300.fc29.x86_64 SMP mod_unload

5 years, 12 months

[OSMO_PCU] EGPRS

by Andrey Lavrukhin

Hi Now I'm trying osmo-pcu on octasic-phy. GPRS worked, but I want to get EGPRS. I set 'gprs mode none' in openbsc.cfg and 'egprs only' in osmo-pcu.cfg. And got next error: "Not accepting non-EGPRS phone in EGPRS-only mode". As I found, it is like bug #3499. What does this error depend on and how can it be fixed? How can I test EGPRS? Thanks, Andrey Lavrukhin

6 years, 2 months

Problem with the sgsnemu of OsmoGGSN

by ArthurLRJ＠outlook.com

Dear all I am facting the following problems and hope you can help me: - At present, I have two GGSN nodes(such as A and B), I also hava a sgsnemu node which is connected to GGSN-A and hold a PDP context, now I want to connect this PDP context to GGSN-B to simulate the handover of mobile devices between different base stations. How can I do it? - And I I wonder if sgsnemu can generate “Update PDP Context Request” message. Thanks and regards Arthur

6 years, 2 months

New osmocom CNI versions released

by Harald Welte

Hi! Just in case not every subscriber here is following the osmocom.org RSS feed: At http://osmocom.org/news/104 we have just announced a bunch of new tagged versions of the Osmocom CNI (cellular network infrastructure) software stack. See the link above for all related details, and links to changelogs. The "network:osmocom:latest" feed already contains builds for Debian 8 and 9, as well as Ubuntu 16.04, 16.10, 17.04, 17.10 and 18.04. Raspbian 9 + Ubuntu 18.10 are currently building, see https://build.opensuse.org/project/monitor/network:osmocom:latest I'd like to thank everyone who has contributed in some way to those new versions. That's primarily the great team of developers, but also everyone helping with testing, bug reports, bug squashing, documentation, etc. Happy hacking, Harald -- - Harald Welte <hwelte(a)sysmocom.de> http://www.sysmocom.de/ ======================================================================= * sysmocom - systems for mobile communications GmbH * Alt-Moabit 93 * 10559 Berlin, Germany * Sitz / Registered office: Berlin, HRB 134158 B * Geschaeftsfuehrer / Managing Director: Harald Welte

6 years, 4 months

Security Issue

by Dhiraj Mishra

Hi List, I found a security issue in libgtpnl osmocom project, could some one please let me know where to submit such bugs ? Thank you

6 years, 5 months

OsmoDevCon 2019 registration

by Harald Welte

Dear fellow Osmocom developers, I'm a bit surprised to notice that not more people have signed up for OsmoDevCon 2019. I guess it was mostly an oversight when the date was originally announced, and not a lack of interest? ;) All details about the event are available at the related wiki page at: https://osmocom.org/projects/osmo-dev-con/wiki/OsmoDevCon2019 Please enter your name at https://osmocom.org/projects/osmo-dev-con/wiki/OsmoDevCon2019#Requested in case you would like to attend. Registering early allows proper planning. Thanks! Looking forward to meeting old and new Osmocom developers in April 2019. Regards, Harald -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

6 years, 5 months

Question about basic usage of GTP kernel module

by Michał Siuda

Hi, I'm trying to build a simple node that would encap/decap between IP and GTP in the user plane. For this I have been using gtp-link and gtp-tunnel tools of the libgtpnl, but with no luck so far. Could anyone please review my setup and let me know what I'm doing wrong? Topology: node1 - DUT, I would like to be able to send a ping from this node such that it is encapsulated into GTP tunnel towards node2. 2 interfaces: - ens6 - represents interface towards MS, has address 20.1.1.1/24 - ens7 - represents interface towards GGSN, has address 10.1.1.1/24 node2 Just a single interface towards node1, address 10.1.1.2/24 Test: On node2, I'm following these steps: - creating a GTP device: # ./gtp-link add gtp-u - adding a GTP tunnel: # ./gtp-tunnel add gtp-u v1 20 10 20.1.1.1 10.1.1.2 # ./gtp-tunnel list version 1 tei 20/10 ms_addr 20.1.1.1 sgsn_addr 10.1.1.2 - adding a route to an address representing APN to use the GTP device: # ip route add 8.8.8.8 src 20.1.1.1 dev gtp-u - Trying to ping 8.8.8.8 Result: I was expecting to see ECMP packets to 8.8.8.8 to be sent out via ens7 towards node2 and encapsulated in GTP. However, I can only see that these packets appear on the gtp-u interface, but are not forwarded. Looking at interface stats on gtp-u, I can see that the ping hits "tx_error" counter. Is there anything I'm missing here? Are any parameters wrong? Or am I misunderstanding the function of the GTP-U kernel support entirely? Any help would be appreciated. Thanks, Michael

6 years, 6 months

Can you tell me how to compile and install libgtpnl?

by luo

hello,Please forgive my childishness,Can you tell me how to compile and install libgtpnl?thanks I saw that you wrote the libgtpnl project on github, but there is no readme above.

6 years, 6 months

← Newer
1
...
17
18
19
20
21
22
23
...
48
Older →

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

osmocom-net-gprs