osmocom-net-gprs

osmocom-net-gprs@lists.osmocom.org

482 discussions

[PATCH net-next v3 0/6] net: Improve netns handling in RTNL and ip_tunnel

by Xiao Liang

This patch series includes some netns-related improvements and fixes for RTNL and ip_tunnel, to make link creation more intuitive: - Creating link in another net namespace doesn't conflict with link names in current one. - Refector rtnetlink link creation. Create link in target namespace directly. Pass both source and link netns to drivers via newlink() callback. So that # ip link add netns ns1 link-netns ns2 tun0 type gre ... will create tun0 in ns1, rather than create it in ns2 and move to ns1. And don't conflict with another interface named "tun0" in current netns. Patch 1 from Donald is included just as a dependency. --- v3: - Drop "netns_atomic" flag and module parameter. Add netns parameter to newlink() instead, and convert drivers accordingly. - Move python NetNSEnter helper to net selftest lib. v2: link: https://lore.kernel.org/all/20241107133004.7469-1-shaw.leon@gmail.com/ - Check NLM_F_EXCL to ensure only link creation is affected. - Add self tests for link name/ifindex conflict and notifications in different netns. - Changes in dummy driver and ynl in order to add the test case. v1: link: https://lore.kernel.org/all/20241023023146.372653-1-shaw.leon@gmail.com/ Donald Hunter (1): Revert "tools/net/ynl: improve async notification handling" Xiao Liang (5): net: ip_tunnel: Build flow in underlay net namespace rtnetlink: Lookup device in target netns when creating link rtnetlink: Decouple net namespaces in rtnl_newlink_create() selftests: net: Add python context manager for netns entering selftests: net: Add two test cases for link netns drivers/infiniband/ulp/ipoib/ipoib_netlink.c | 6 ++- drivers/net/amt.c | 6 +-- drivers/net/bareudp.c | 4 +- drivers/net/bonding/bond_netlink.c | 3 +- drivers/net/can/dev/netlink.c | 2 +- drivers/net/can/vxcan.c | 4 +- .../ethernet/qualcomm/rmnet/rmnet_config.c | 5 +- drivers/net/geneve.c | 4 +- drivers/net/gtp.c | 4 +- drivers/net/ipvlan/ipvlan.h | 2 +- drivers/net/ipvlan/ipvlan_main.c | 5 +- drivers/net/ipvlan/ipvtap.c | 4 +- drivers/net/macsec.c | 5 +- drivers/net/macvlan.c | 5 +- drivers/net/macvtap.c | 5 +- drivers/net/netkit.c | 4 +- drivers/net/pfcp.c | 4 +- drivers/net/ppp/ppp_generic.c | 4 +- drivers/net/team/team_core.c | 2 +- drivers/net/veth.c | 4 +- drivers/net/vrf.c | 2 +- drivers/net/vxlan/vxlan_core.c | 4 +- drivers/net/wireguard/device.c | 4 +- drivers/net/wireless/virtual/virt_wifi.c | 5 +- drivers/net/wwan/wwan_core.c | 6 ++- include/net/ip_tunnels.h | 5 +- include/net/rtnetlink.h | 22 ++++++++- net/8021q/vlan_netlink.c | 5 +- net/batman-adv/soft-interface.c | 5 +- net/bridge/br_netlink.c | 2 +- net/caif/chnl_net.c | 2 +- net/core/rtnetlink.c | 25 ++++++---- net/hsr/hsr_netlink.c | 8 +-- net/ieee802154/6lowpan/core.c | 5 +- net/ipv4/ip_gre.c | 13 +++-- net/ipv4/ip_tunnel.c | 16 +++--- net/ipv4/ip_vti.c | 5 +- net/ipv4/ipip.c | 5 +- net/ipv6/ip6_gre.c | 17 ++++--- net/ipv6/ip6_tunnel.c | 11 ++--- net/ipv6/ip6_vti.c | 11 ++--- net/ipv6/sit.c | 11 ++--- net/xfrm/xfrm_interface_core.c | 13 +++-- tools/net/ynl/cli.py | 10 ++-- tools/net/ynl/lib/ynl.py | 49 ++++++++----------- tools/testing/selftests/net/Makefile | 1 + .../testing/selftests/net/lib/py/__init__.py | 2 +- tools/testing/selftests/net/lib/py/netns.py | 18 +++++++ tools/testing/selftests/net/netns-name.sh | 10 ++++ tools/testing/selftests/net/netns_atomic.py | 38 ++++++++++++++ 50 files changed, 255 insertions(+), 157 deletions(-) create mode 100755 tools/testing/selftests/net/netns_atomic.py -- 2.47.0

8 months, 2 weeks

[PATCH net] gtp: allow -1 to be specified as file description from userspace

by Pablo Neira Ayuso

Existing user space applications maintained by the Osmocom project are breaking since a recent fix that addresses incorrect error checking. Restore operation for user space programs that specify -1 as file descriptor to skip GTPv0 or GTPv1 only sockets. Fixes: defd8b3c37b0 ("gtp: fix a potential NULL pointer dereference") Reported-by: Pau Espin Pedrol <pespin(a)sysmocom.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> --- drivers/net/gtp.c | 22 +++++++++++++--------- 1 file changed, 13 insertions(+), 9 deletions(-) diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c index a60bfb1abb7f..70f981887518 100644 --- a/drivers/net/gtp.c +++ b/drivers/net/gtp.c @@ -1702,20 +1702,24 @@ static int gtp_encap_enable(struct gtp_dev *gtp, struct nlattr *data[]) return -EINVAL; if (data[IFLA_GTP_FD0]) { - u32 fd0 = nla_get_u32(data[IFLA_GTP_FD0]); + int fd0 = nla_get_u32(data[IFLA_GTP_FD0]); - sk0 = gtp_encap_enable_socket(fd0, UDP_ENCAP_GTP0, gtp); - if (IS_ERR(sk0)) - return PTR_ERR(sk0); + if (fd0 >= 0) { + sk0 = gtp_encap_enable_socket(fd0, UDP_ENCAP_GTP0, gtp); + if (IS_ERR(sk0)) + return PTR_ERR(sk0); + } } if (data[IFLA_GTP_FD1]) { - u32 fd1 = nla_get_u32(data[IFLA_GTP_FD1]); + int fd1 = nla_get_u32(data[IFLA_GTP_FD1]); - sk1u = gtp_encap_enable_socket(fd1, UDP_ENCAP_GTP1U, gtp); - if (IS_ERR(sk1u)) { - gtp_encap_disable_sock(sk0); - return PTR_ERR(sk1u); + if (fd1 >= 0) { + sk1u = gtp_encap_enable_socket(fd1, UDP_ENCAP_GTP1U, gtp); + if (IS_ERR(sk1u)) { + gtp_encap_disable_sock(sk0); + return PTR_ERR(sk1u); + } } } -- 2.30.2

9 months

libgtp API strategy for Gn (SGSN <> MME)

by Alexander 'lynxis' Couzens

Hi, I'm currently looking into extending the libgtp interface to support Gn. Gn will be used between a SGSN and a MME to transfer UE state. This allows a UE to have mobility between 2G/3G network served by an SGSN and a 4G network served by an MME. It is based on GTPv1 TS 29.060 and to simply contains 3 PDUs: - 7.5.3 SGSN Context Request, - 7.5.4 SGSN Context Response - 7.5.5 SGSN Context Ack It can work in both direction for UE from 2G to 4G as well 4G to 2G. The SGSN Context Request creates its own GTP session by exchanging a TEID-C in the SGSN Req + Resp. E.g.: MME -> SGSN: SGSN Context Request (TEID 0, new TEID A) MME <- SGSN: SGSN Context Response (TEID A, new TEID B) MME -> SGSN: SGSN Context Ack (TEID B) But the API of libgtp is currently very high level, except for RAN Info Relay, a user doesn't interact with the GTP TLVs, instead it is using a struct and converts between each other. Libgtp was developed with GTPv0/v1 in mind to support requesting PDP Context for 2G (and later got extended to support 3G). Also the SGSN Context Response contains a very long list of optional TLVs (e.g. 27 in Rel 12), some of the TLVs also contain nested TLVs. So what is the right direction? Should I create a new high level API, parse only the 3-4 TLVs the SGSN will use into a `struct sgsn_response`? Also the state tracking of a request would be tracked then by GTP and passed as identifier to it. Or it could pass it to the SGSN and the SGSN has to take care of everything (except general message and tlv validation, parsing)? Best, lynxis

9 months, 1 week

Why did you have to consider gradeoneessay.com

by chafinwalker＠gmail.com

I’m Gradeoneessay.com and I emerge as the <a href="https://gradeoneessay.com/best-nursing-paper-help-website">Best Nursing Paper Help Website</a> for nursing students seeking assistance with their academic papers. With a team of seasoned professionals who boast extensive experience and expertise in the nursing field, Gradeoneessay.com sets itself apart as the go-to platform for top-notch paper writing services. Every assignment, whether it's a research paper, essay, or case study, is meticulously crafted with precision and insight, ensuring that students receive tailored solutions that meet the highest standards of excellence. The personalized approach taken by Gradeoneessay.com ensures that each paper is customized to the unique requirements and preferences of the student, fostering a collaborative partnership that yields exceptional results. Timely delivery is paramount at Gradeoneessay.com, with a commitment to meeting even the most stringent deadlines without compromising on quality. The streamlined workflow and dedication of the writing team ensure prompt delivery of <a href="https://gradeoneessay.com/sim405-professional-values/">SIM405 Professional Values</a>, offering students peace of mind and alleviating the stress of last-minute submissions. Furthermore, Gradeoneessay.com's transparent pricing model ensures affordability without sacrificing quality, making their services accessible to nursing students operating within tight budgets. Various discounts and special offers further enhance the affordability factor, making Gradeoneessay.com the ideal choice for students seeking value for their money. In addition to paper writing assistance, Gradeoneessay.com offers a comprehensive suite of services to meet all academic needs. From proofreading and editing to research assistance and support for online nursing classes, Gradeoneessay.com goes above and beyond to support students in their academic endeavors such as <a href="https://gradeoneessay.com/nurs440-issues-and-trends-in-nursing">NURS440 Issues and Trends in Nursing</a>. The unwavering commitment to customer satisfaction is evident in Gradeoneessay.com's round-the-clock support, where a dedicated team is available to address any queries or concerns promptly and courteously. With <a href="https://gradeoneessay.com">Gradeoneessay.com</a> as their ally, nursing students can navigate the challenges of academia with confidence and ease, knowing that they have the support of a trusted partner committed to their success.

1 year, 3 months

Professional Dissertation Writing Help

by markanderson8093＠gmail.com

[NURS FPX 4020 Assessment 1](https://onlineclassassignment.com/nurs-fpx-4020-assessment-1-improving-q… the dynamic landscape of healthcare, nursing leadership plays a pivotal role in shaping the delivery of quality patient care. NURS FPX 4020 Assessment 1 is a crucial component of the nursing curriculum, focusing on cultivating leadership skills that are essential for addressing complex challenges within healthcare systems. This article delves into the significance of Assessment 1 and its connection to NHS-FPX 5004 Assessment 1. NURS FPX 4020 Assessment 1 is a cornerstone in the journey of aspiring nurse leaders. This assessment is meticulously designed to provide nursing students with a comprehensive understanding of leadership theories, strategies, and practical applications that empower them to drive positive changes within healthcare organizations. Leadership Theories and Models: Assessment 1 delves into various leadership theories, offering students insights into transformational, situational, and servant leadership, among others. This exposure enables students to identify leadership styles that align with their values and the unique demands of healthcare settings. Strategic Decision-Making: Nursing leaders are often required to make strategic decisions that impact patient care, resource allocation, and organizational outcomes. Assessment 1 equips students with the skills to analyze complex situations, evaluate options, and make informed decisions that uphold patient-centered care. Communication and Team Building: Effective leadership hinges on clear communication and fostering collaborative teams. Assessment 1 guides students in honing communication skills, conflict resolution techniques, and strategies for building cohesive and high-performing healthcare teams. Change Management: In the ever-evolving healthcare landscape, adaptability and change management are critical. Assessment 1 prepares students to lead and manage change initiatives, ensuring smooth transitions that enhance patient care quality. NURS FPX 4020 Assessment 1 yields transformative outcomes for nursing students: Leadership Competence: By mastering leadership theories and practical skills, students develop the competence to lead with confidence, promoting a positive influence on their teams and patient outcomes. Strategic Vision: Assessment 1 instills a strategic mindset, enabling nursing leaders to envision and implement improvements that align with organizational goals while prioritizing patient welfare. Collaborative Excellence: Effective communication and team-building skills fostered by Assessment 1 enhance collaboration among healthcare professionals, leading to enhanced care coordination and patient safety. Change Catalysts: Nursing professionals who excel in Assessment 1 become adept at navigating change, fostering an environment where innovation and continuous improvement thrive. NHS-FPX 5004 Assessment 1 is an extension of the leadership foundation laid by NURS FPX 4020 Assessment 1\. While the latter focuses on nursing leadership within broader healthcare contexts, NHS-FPX 5004 Assessment 1 specifically addresses leadership and management within the NHS, offering insights into the unique challenges and opportunities within the UK healthcare system. NURS FPX 4020 Assessment 1 serves as a beacon guiding nursing students towards impactful leadership roles within the healthcare sector. By imparting leadership theories, strategic acumen, and effective communication strategies, Assessment 1 transforms students into dynamic nursing leaders capable of navigating complex healthcare environments. As they progress to [NHS-FPX 5004 Assessment 1](https://onlineclassassignment.com/nurs-fpx-5004-assessment-1-leadership-…, students are poised to apply their leadership prowess within the context of the NHS, ultimately contributing to the enhancement of patient care, healthcare systems, and the nursing profession as a whole.

1 year, 3 months

[PATCH] net: gtp: Fix Use-After-Free in gtp_dellink

by Hyunwoo Kim

Since call_rcu, which is called in the hlist_for_each_entry_rcu traversal of gtp_dellink, is not part of the RCU read critical section, it is possible that the RCU grace period will pass during the traversal and the key will be free. To prevent this, it should be changed to hlist_for_each_entry_safe. Fixes: 94dc550a5062 ("gtp: fix an use-after-free in ipv4_pdp_find()") Signed-off-by: Hyunwoo Kim <v4bel(a)theori.io> --- drivers/net/gtp.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c index ba4704c2c640..e62d6cbdf9bc 100644 --- a/drivers/net/gtp.c +++ b/drivers/net/gtp.c @@ -1098,11 +1098,12 @@ static int gtp_newlink(struct net *src_net, struct net_device *dev, static void gtp_dellink(struct net_device *dev, struct list_head *head) { struct gtp_dev *gtp = netdev_priv(dev); + struct hlist_node *next; struct pdp_ctx *pctx; int i; for (i = 0; i < gtp->hash_size; i++) - hlist_for_each_entry_rcu(pctx, &gtp->tid_hash[i], hlist_tid) + hlist_for_each_entry_safe(pctx, next, &gtp->tid_hash[i], hlist_tid) pdp_context_delete(pctx); list_del_rcu(&gtp->list); -- 2.34.1

1 year, 3 months

OsmoSGSN - "Cannot handle SM for unknown MM CTX"

by Jan Kosiński

Hello, I got question about this issue. I updated my comment on this issue here: https://osmocom.org/issues/6197 Original my post: I observe same situation in my setup. Cannot activate PDP context because of missing RA-CAPABILTIY-UPDATE and RA-CAPABILITY-ACK support in osmoSGSN. My setup is Samsung Galaxy S9 and S23, real BTS/BSC from well-known vendor and Osmo core (SGSN/GGSN/HLR/MSC/STP) (Important thing that I'm not using osmo-pcu). Problem description: S9 attach procedure (CS+PS): 1.After UE reboot I see MM procedure Location request and Location update processed good (on DMtool). Then if needed CS calling is working properly(connection to osmoMSC). 2.After that UE is trying GMM Attach request and it got Attach accept and attach complete. 3.Then UE send Activate PDP context, but SGSN is reject this with cause: "Cannot handle SM for unknown MM CTX" 4.After that UE is trying activate PDP context for second time (After timer expired) and finally it got pdp accept (ping/traffic work) same as in this thread. After deep inspection I found that reason of first pdp activation reject is that TLLI is not updated (SGSN dont know it and causing Cannot handle SM for unknown MM CTX) because when I checked pcap from bssgp I see that BSC send RA-CAPABILTIY-UPDATE with new tlli and osmoSGSN send response Unknown PDU with protocol unspecified but should send RA-CAPABILTIY-UPDATE-ACK. Other thing I dont understand that in msg comes from bsc on bvci 127 but respond goes to bvci 0 (but I didnt define it as bsc-sgsn link use only bvci 127 not bvci 0).Also I think sig bvci 0 is not changeable to bvci 127 on osmoSGSN. To summarize attach procedure is long it takes 30-50 seconds(because of this first reject). S23 attach Same as S9 but after first fail it not doing second attempt and stuck without PS forever in CS domain. Its not problem with MS stack. I tried a lot of workarounds to make s23 attach but no success. Changing to PSonly not work, AT commands not work. Also tried with Huawei E3372,E3131 but same behaviour. I connect this setup to other 2Gcore-simulator(not opensource) to compare and its processed normally for both UEs and modems,it got pdp contexts after 6-8 seconds. Difference is that here I got message RA-CAPABILTIY-UPDATE/RA-CAPABILITY-ACK because got real BSC not osmo-pcu. When I look into code I cannot see RA-CAPABILTIY-UPDATE and RA-CAPABILITY-ACK support so my questions are: 1.Is this RA-CAPABILTIY-UPDATE and RA-CAPABILITY-ACK supported in osmoSGSN and is it plan to do that? 2.Is any other workaround (changing timers,tmsi assignment or whatever to change in bsc) in configuration to make S23/modems attached?Theoretically if UE can set PSonly and AT command to activate PDP context it should work but I never make it happened this AT commands on my terminals. 3.I can provide both pcaps and UE logs to see whats missing if it helps to make add it. 4.Is it possible to add this two messages to support to osmoSGSN code?I can test patch if you provide it. Regards, Jan Kosiński

1 year, 4 months

osmoSGSN- "Cannot handle SM for unknown MM CTX"

by Jan Kosiński

1 year, 4 months

[PATCH net-next 1/3] net: gtp: Leverage core stats allocator

by Breno Leitao

With commit 34d21de99cea9 ("net: Move {l,t,d}stats allocation to core and convert veth & vrf"), stats allocation could be done on net core instead of in this driver. With this new approach, the driver doesn't have to bother with error handling (allocation failure checking, making sure free happens in the right spot, etc). This is core responsibility now. Remove the allocation in the gtp driver and leverage the network core allocation instead. Signed-off-by: Breno Leitao <leitao(a)debian.org> --- drivers/net/gtp.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c index 2b46b7398ade..facbfba5d77f 100644 --- a/drivers/net/gtp.c +++ b/drivers/net/gtp.c @@ -717,10 +717,6 @@ static int gtp_dev_init(struct net_device *dev) gtp->dev = dev; - dev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats); - if (!dev->tstats) - return -ENOMEM; - return 0; } @@ -729,7 +725,6 @@ static void gtp_dev_uninit(struct net_device *dev) struct gtp_dev *gtp = netdev_priv(dev); gtp_encap_disable(gtp); - free_percpu(dev->tstats); } static inline void gtp0_push_header(struct sk_buff *skb, struct pdp_ctx *pctx) @@ -970,6 +965,7 @@ static void gtp_link_setup(struct net_device *dev) dev->type = ARPHRD_NONE; dev->flags = IFF_POINTOPOINT | IFF_NOARP | IFF_MULTICAST; + dev->pcpu_stat_type = NETDEV_PCPU_STAT_TSTATS; dev->priv_flags |= IFF_NO_QUEUE; dev->features |= NETIF_F_LLTX; netif_keep_dst(dev); -- 2.43.0

1 year, 4 months

[PATCH 0/1] gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp()

by kovalev＠altlinux.org

Syzkaller hit 'general protection fault in gtp_genl_dump_pdp' bug. This bug is not a vulnerability and is reproduced only when running with root privileges. dmesg (5.10.200): gtp: GTP module loaded (pdp ctx size 104 bytes) gtp: GTP module unloaded general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 0 PID: 2782 Comm: syz-executor139 Not tainted 5.10.200-std-def-alt1 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-alt1 04/01/2014 RIP: 0010:gtp_genl_dump_pdp+0x1b1/0x790 [gtp] Code: c4 89 c6 e8 b1 07 15 e0 58 45 85 e4 0f 85 97 03 00 00 e8 72 0b 15 e0 48 8b 54 24 20 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 ac 05 00 00 48 8b 44 24 20 48 8b 08 48 89 0c 24 RSP: 0018:ffff8881146c73f8 EFLAGS: 00010213 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffffa137fa66 RDX: 0000000000000001 RSI: ffffffffa137f6be RDI: 0000000000000001 gtp: GTP module loaded (pdp ctx size 104 bytes) RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff86c4dca7 R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001 R13: 0000000000000000 R14: ffff888133b04588 R15: 0000000000000000 FS: 00007f2ea15c5740(0000) GS:ffff888140200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f2ea17686cf CR3: 000000010e56c000 CR4: 0000000000750ef0 PKRU: 55555554 Call Trace: genl_lock_dumpit+0x6b/0xa0 net/netlink/genetlink.c:623 netlink_dump+0x575/0xc70 net/netlink/af_netlink.c:2271 __netlink_dump_start+0x64e/0x910 net/netlink/af_netlink.c:2376 genl_family_rcv_msg_dumpit+0x2b8/0x310 net/netlink/genetlink.c:686 genl_family_rcv_msg net/netlink/genetlink.c:780 [inline] genl_rcv_msg+0x450/0x5a0 net/netlink/genetlink.c:800 netlink_rcv_skb+0x150/0x440 net/netlink/af_netlink.c:2497 genl_rcv+0x29/0x40 net/netlink/genetlink.c:811 netlink_unicast_kernel net/netlink/af_netlink.c:1322 [inline] netlink_unicast+0x54e/0x800 net/netlink/af_netlink.c:1348 netlink_sendmsg+0x914/0xe00 net/netlink/af_netlink.c:1916 sock_sendmsg_nosec net/socket.c:651 [inline] __sock_sendmsg+0x159/0x190 net/socket.c:663 ____sys_sendmsg+0x712/0x870 net/socket.c:2376 ___sys_sendmsg+0xf8/0x170 net/socket.c:2430 __sys_sendmsg+0xea/0x1b0 net/socket.c:2459 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x62/0xc7 RIP: 0033:0x7f2ea16c2d49 Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d ef 70 0d 00 f7 d8 64 89 01 48 RSP: 002b:00007ffc93f6ed78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00000000000f4240 RCX: 00007f2ea16c2d49 RDX: 0000000020040840 RSI: 0000000020000940 RDI: 0000000000000003 RBP: 0000000000000000 R08: 00007ffc93f6eb08 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000be43 R13: 00007ffc93f6ed8c R14: 00007ffc93f6eda0 R15: 00007ffc93f6ed90 Modules linked in: gtp udp_tunnel ide_cd_mod ide_gd_mod cdrom ata_generic pata_acpi ata_piix libata scsi_mod ide_pci_generic ppdev kvm_amd joydev ccp kvm irqbypass crct10dif_pclmul crc32_pclmul crc32c_intel ghash_clmulni_intel bochs_drm drm_vram_helper drm_ttm_helper ttm drm_kms_helper aesni_intel crypto_simd evdev cec input_leds psmouse af_packet i2c_piix4 rc_core cryptd glue_helper serio_raw piix pcspkr intel_agp intel_gtt ide_core tiny_power_button floppy parport_pc parport qemu_fw_cfg button sch_fq_codel fuse drm dm_mod binfmt_misc efi_pstore virtio_rng rng_core ip_tables x_tables autofs4 [last unloaded: gtp] ---[ end trace 3a80aa87ef53345b ]--- RIP: 0010:gtp_genl_dump_pdp+0x1b1/0x790 [gtp] Code: c4 89 c6 e8 b1 07 15 e0 58 45 85 e4 0f 85 97 03 00 00 e8 72 0b 15 e0 48 8b 54 24 20 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 ac 05 00 00 48 8b 44 24 20 48 8b 08 48 89 0c 24 RSP: 0018:ffff8881146c73f8 EFLAGS: 00010213 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffffa137fa66 RDX: 0000000000000001 RSI: ffffffffa137f6be RDI: 0000000000000001 RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff86c4dca7 R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001 R13: 0000000000000000 R14: ffff888133b04588 R15: 0000000000000000 FS: 00007f2ea15c5740(0000) GS:ffff888140200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f2ea17686cf CR3: 000000010e56c000 CR4: 0000000000750ef0 PKRU: 55555554 note: syz-executor139[2782] exited with preempt_count 1 ---------------- Code disassembly (best guess), 1 bytes skipped: 0: 89 c6 mov %eax,%esi 2: e8 b1 07 15 e0 callq 0xe01507b8 7: 58 pop %rax 8: 45 85 e4 test %r12d,%r12d b: 0f 85 97 03 00 00 jne 0x3a8 11: e8 72 0b 15 e0 callq 0xe0150b88 16: 48 8b 54 24 20 mov 0x20(%rsp),%rdx 1b: 48 b8 00 00 00 00 00 fc ff df movabs $0xdffffc0000000000,%rax 25: 48 c1 ea 03 shr $0x3,%rdx * 29: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) <-- trapping instruction 2d: 0f 85 ac 05 00 00 jne 0x5df 33: 48 8b 44 24 20 mov 0x20(%rsp),%rax 38: 48 8b 08 mov (%rax),%rcx 3b: 48 89 0c 24 mov %rcx,(%rsp) C reproducer: // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include <arpa/inet.h> #include <dirent.h> #include <endian.h> #include <errno.h> #include <fcntl.h> #include <net/if.h> #include <netinet/in.h> #include <signal.h> #include <stdarg.h> #include <stdbool.h> #include <stdint.h> #include <stdio.h> #include <stdlib.h> #include <string.h> #include <sys/prctl.h> #include <sys/socket.h> #include <sys/stat.h> #include <sys/syscall.h> #include <sys/types.h> #include <sys/wait.h> #include <time.h> #include <unistd.h> #include <linux/genetlink.h> #include <linux/if_addr.h> #include <linux/if_link.h> #include <linux/in6.h> #include <linux/neighbour.h> #include <linux/net.h> #include <linux/netlink.h> #include <linux/rtnetlink.h> #include <linux/veth.h> static unsigned long long procid; static void sleep_ms(uint64_t ms) { usleep(ms * 1000); } static uint64_t current_time_ms(void) { struct timespec ts; if (clock_gettime(CLOCK_MONOTONIC, &ts)) exit(1); return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; } static bool write_file(const char* file, const char* what, ...) { char buf[1024]; va_list args; va_start(args, what); vsnprintf(buf, sizeof(buf), what, args); va_end(args); buf[sizeof(buf) - 1] = 0; int len = strlen(buf); int fd = open(file, O_WRONLY | O_CLOEXEC); if (fd == -1) return false; if (write(fd, buf, len) != len) { int err = errno; close(fd); errno = err; return false; } close(fd); return true; } struct nlmsg { char* pos; int nesting; struct nlattr* nested[8]; char buf[4096]; }; static void netlink_init(struct nlmsg* nlmsg, int typ, int flags, const void* data, int size) { memset(nlmsg, 0, sizeof(*nlmsg)); struct nlmsghdr* hdr = (struct nlmsghdr*)nlmsg->buf; hdr->nlmsg_type = typ; hdr->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK | flags; memcpy(hdr + 1, data, size); nlmsg->pos = (char*)(hdr + 1) + NLMSG_ALIGN(size); } static void netlink_attr(struct nlmsg* nlmsg, int typ, const void* data, int size) { struct nlattr* attr = (struct nlattr*)nlmsg->pos; attr->nla_len = sizeof(*attr) + size; attr->nla_type = typ; if (size > 0) memcpy(attr + 1, data, size); nlmsg->pos += NLMSG_ALIGN(attr->nla_len); } static int netlink_send_ext(struct nlmsg* nlmsg, int sock, uint16_t reply_type, int* reply_len, bool dofail) { if (nlmsg->pos > nlmsg->buf + sizeof(nlmsg->buf) || nlmsg->nesting) exit(1); struct nlmsghdr* hdr = (struct nlmsghdr*)nlmsg->buf; hdr->nlmsg_len = nlmsg->pos - nlmsg->buf; struct sockaddr_nl addr; memset(&addr, 0, sizeof(addr)); addr.nl_family = AF_NETLINK; ssize_t n = sendto(sock, nlmsg->buf, hdr->nlmsg_len, 0, (struct sockaddr*)&addr, sizeof(addr)); if (n != (ssize_t)hdr->nlmsg_len) { if (dofail) exit(1); return -1; } n = recv(sock, nlmsg->buf, sizeof(nlmsg->buf), 0); if (reply_len) *reply_len = 0; if (n < 0) { if (dofail) exit(1); return -1; } if (n < (ssize_t)sizeof(struct nlmsghdr)) { errno = EINVAL; if (dofail) exit(1); return -1; } if (hdr->nlmsg_type == NLMSG_DONE) return 0; if (reply_len && hdr->nlmsg_type == reply_type) { *reply_len = n; return 0; } if (n < (ssize_t)(sizeof(struct nlmsghdr) + sizeof(struct nlmsgerr))) { errno = EINVAL; if (dofail) exit(1); return -1; } if (hdr->nlmsg_type != NLMSG_ERROR) { errno = EINVAL; if (dofail) exit(1); return -1; } errno = -((struct nlmsgerr*)(hdr + 1))->error; return -errno; } static int netlink_query_family_id(struct nlmsg* nlmsg, int sock, const char* family_name, bool dofail) { struct genlmsghdr genlhdr; memset(&genlhdr, 0, sizeof(genlhdr)); genlhdr.cmd = CTRL_CMD_GETFAMILY; netlink_init(nlmsg, GENL_ID_CTRL, 0, &genlhdr, sizeof(genlhdr)); netlink_attr(nlmsg, CTRL_ATTR_FAMILY_NAME, family_name, strnlen(family_name, GENL_NAMSIZ - 1) + 1); int n = 0; int err = netlink_send_ext(nlmsg, sock, GENL_ID_CTRL, &n, dofail); if (err < 0) { return -1; } uint16_t id = 0; struct nlattr* attr = (struct nlattr*)(nlmsg->buf + NLMSG_HDRLEN + NLMSG_ALIGN(sizeof(genlhdr))); for (; (char*)attr < nlmsg->buf + n; attr = (struct nlattr*)((char*)attr + NLMSG_ALIGN(attr->nla_len))) { if (attr->nla_type == CTRL_ATTR_FAMILY_ID) { id = *(uint16_t*)(attr + 1); break; } } if (!id) { errno = EINVAL; return -1; } recv(sock, nlmsg->buf, sizeof(nlmsg->buf), 0); return id; } static long syz_genetlink_get_family_id(volatile long name, volatile long sock_arg) { int fd = sock_arg; if (fd < 0) { fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC); if (fd == -1) { return -1; } } struct nlmsg nlmsg_tmp; int ret = netlink_query_family_id(&nlmsg_tmp, fd, (char*)name, false); if ((int)sock_arg < 0) close(fd); if (ret < 0) { return -1; } return ret; } static void kill_and_wait(int pid, int* status) { kill(-pid, SIGKILL); kill(pid, SIGKILL); for (int i = 0; i < 100; i++) { if (waitpid(-1, status, WNOHANG | __WALL) == pid) return; usleep(1000); } DIR* dir = opendir("/sys/fs/fuse/connections"); if (dir) { for (;;) { struct dirent* ent = readdir(dir); if (!ent) break; if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0) continue; char abort[300]; snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort", ent->d_name); int fd = open(abort, O_WRONLY); if (fd == -1) { continue; } if (write(fd, abort, 1) < 0) { } close(fd); } closedir(dir); } else { } while (waitpid(-1, status, __WALL) != pid) { } } static void setup_test() { prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); setpgrp(); write_file("/proc/self/oom_score_adj", "1000"); } static void execute_one(void); #define WAIT_FLAGS __WALL static void loop(void) { int iter = 0; for (;; iter++) { int pid = fork(); if (pid < 0) exit(1); if (pid == 0) { setup_test(); execute_one(); exit(0); } int status = 0; uint64_t start = current_time_ms(); for (;;) { if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) break; sleep_ms(1); if (current_time_ms() - start < 5000) continue; kill_and_wait(pid, &status); break; } } } uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff}; void execute_one(void) { intptr_t res = 0; memcpy((void*)0x20000140, "gtp\000", 4); syscall(__NR_delete_module, 0x20000140ul, 0x5000000ul); res = syscall(__NR_socket, 0x10ul, 3ul, 0x10); if (res != -1) r[0] = res; memcpy((void*)0x20000100, "gtp\000", 4); res = -1; res = syz_genetlink_get_family_id(0x20000100, -1); if (res != -1) r[1] = res; *(uint64_t*)0x20000940 = 0; *(uint32_t*)0x20000948 = 0; *(uint64_t*)0x20000950 = 0x20000900; *(uint64_t*)0x20000900 = 0x20000140; memcpy((void*)0x20000140, "$\000\000\000", 4); *(uint16_t*)0x20000144 = r[1]; memcpy((void*)0x20000146, "\x13\x03\xfc\xff\xff\xff\xfe\xdb\xdf\x25\x02\x00\x00\x00\x08\x00\x02\x00\x01\x00\x00\x00\x08\x00\x01\x00", 26); *(uint32_t*)0x20000160 = 0; *(uint64_t*)0x20000164 = r[1]; *(uint32_t*)0x2000016c = -1; *(uint64_t*)0x20000170 = -1; sprintf((char*)0x20000178, "0x%016llx", (long long)-1); *(uint64_t*)0x20000908 = 0x24; *(uint64_t*)0x20000958 = 1; *(uint64_t*)0x20000960 = 0; *(uint64_t*)0x20000968 = 0; *(uint32_t*)0x20000970 = 0; syscall(__NR_sendmsg, r[0], 0x20000940ul, 0x20040840ul); } int main(void) { syscall(__NR_mmap, 0x1ffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul); syscall(__NR_mmap, 0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul); for (procid = 0; procid < 6; procid++) { if (fork() == 0) { loop(); } } sleep(1000000); return 0; } The bug is also reproduced on the latest stable kernels with the KASAN sanitizer disabled: dmesg (6.6.13): [ 523.894617] gtp: GTP module loaded (pdp ctx size 104 bytes) [ 523.908033] gtp: GTP module unloaded [ 523.914798] BUG: kernel NULL pointer dereference, address: 0000000000000012 [ 523.915255] #PF: supervisor read access in kernel mode [ 523.915255] #PF: error_code(0x0000) - not-present page [ 523.915255] PGD 2a0b9067 P4D 2a0b9067 PUD 6ccc067 PMD 0 [ 523.915255] Oops: 0000 [#1] PREEMPT SMP NOPTI [ 523.915255] CPU: 1 PID: 9263 Comm: repro7 Not tainted 6.6.13-un-def-alt1 #1 [ 523.915255] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.0-alt1 04/01/2014 [ 523.915255] RIP: 0010:gtp_genl_dump_pdp+0x82/0x190 [gtp] [ 523.915255] Code: 70 00 74 21 48 83 c4 18 5b 5d 41 5c 41 5d 41 5e 41 5f 31 d2 31 c9 31 f6 31 ff 45 31 c0 45 31 c9 c3 cc cc cc cc e8 0e 0b 57 c0 <4c> 8b 23 49 39 dc 74 22 44 89 6c 24 04 44 8b 6c 24 08 4d 85 ff 74 [ 523.915255] RSP: 0018:ffffc900017338a8 EFLAGS: 00010246 [ 523.915255] RAX: 0000000000000000 RBX: 0000000000000012 RCX: 0000000000000000 [ 523.915255] RDX: 0000000000000000 RSI: ffff88800713bb60 RDI: 0000000000000000 [ 523.915255] RBP: ffff88800632b200 R08: 0000000000000000 R09: 0000000000000000 [ 523.915255] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 523.915255] R13: 0000000000000000 R14: ffff88800713bb60 R15: 0000000000000000 [ 523.915255] FS: 00007f2bcb83f740(0000) GS:ffff88807dc80000(0000) knlGS:0000000000000000 [ 523.915255] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 523.915255] CR2: 0000000000000012 CR3: 0000000052420000 CR4: 0000000000750ee0 [ 523.915255] PKRU: 55555554 [ 523.915255] Call Trace: [ 523.915255] <TASK> [ 523.915255] ? __die+0x1f/0x70 [ 523.915255] ? page_fault_oops+0x14d/0x4a0 [ 523.915255] ? exc_page_fault+0x7b/0x180 [ 523.915255] ? asm_exc_page_fault+0x22/0x30 [ 523.915255] ? gtp_genl_dump_pdp+0x82/0x190 [gtp] [ 523.915255] ? gtp_genl_dump_pdp+0x82/0x190 [gtp] [ 523.915255] genl_dumpit+0x2f/0x90 [ 523.915255] netlink_dump+0x126/0x320 [ 523.915255] __netlink_dump_start+0x1da/0x2a0 [ 523.915255] genl_family_rcv_msg_dumpit+0x93/0x100 [ 523.915255] ? __pfx_genl_start+0x10/0x10 [ 523.915255] ? __pfx_genl_dumpit+0x10/0x10 [ 523.915255] ? __pfx_genl_done+0x10/0x10 [ 523.915255] genl_rcv_msg+0x112/0x2a0 [ 523.915255] ? __pfx_gtp_genl_dump_pdp+0x10/0x10 [gtp] [ 523.915255] ? __pfx_genl_rcv_msg+0x10/0x10 [ 523.915255] netlink_rcv_skb+0x54/0x110 [ 523.915255] genl_rcv+0x24/0x40 [ 523.915255] netlink_unicast+0x19f/0x290 [ 523.915255] netlink_sendmsg+0x250/0x4e0 [ 523.915255] ____sys_sendmsg+0x376/0x3b0 [ 523.915255] ? copy_msghdr_from_user+0x6d/0xb0 [ 523.915255] ___sys_sendmsg+0x86/0xe0 [ 523.915255] ? do_fault+0x296/0x470 [ 523.915255] ? __handle_mm_fault+0x771/0xda0 [ 523.915255] __sys_sendmsg+0x57/0xb0 [ 523.915255] do_syscall_64+0x59/0x90 [ 523.915255] ? ct_kernel_exit.isra.0+0x71/0x90 [ 523.915255] ? __ct_user_enter+0x5a/0xd0 [ 523.915255] entry_SYSCALL_64_after_hwframe+0x6e/0xd8 [ 523.915255] RIP: 0033:0x7f2bcb93cd49 [ 523.915255] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d ef 70 0d 00 f7 d8 64 89 01 48 [ 523.915255] RSP: 002b:00007ffe5d907708 EFLAGS: 00000202 ORIG_RAX: 000000000000002e [ 523.915255] RAX: ffffffffffffffda RBX: 0000562f4a49f0a0 RCX: 00007f2bcb93cd49 [ 523.915255] RDX: 0000000020040840 RSI: 0000000020000940 RDI: 0000000000000003 [ 523.915255] RBP: 00007ffe5d907720 R08: 00007ffe5d907498 R09: 00007ffe5d907720 [ 523.915255] R10: 0000000000000000 R11: 0000000000000202 R12: 0000562f4a49e210 [ 523.915255] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 523.915255] </TASK> [PATCH 1/1] gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp()

1 year, 5 months

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

osmocom-net-gprs