Two races exist around the sk_created flag in the GTP driver: an initialization ordering issue where sk_created is published before the socket pointers are assigned, and a teardown lifetime issue where concurrent readers can still use the sockets after they are freed. They are split into separate patches because they require fundamentally different fixes -- memory barriers for ordering vs synchronize_net() and RTNL for lifetime.
Changes since v1 [1]: - Use smp_store_release()/smp_load_acquire() for proper memory ordering as suggested by Simon Horman. - Add patch 2/2 to fix teardown races in gtp_encap_disable(): reorder to clear sk_created first, add synchronize_net() for softirq paths, and hold RTNL in gtp_genl_send_echo_req() for the process-context path that synchronize_net() cannot protect.
Patch 1/2 fixes the initialization ordering race. Patch 2/2 fixes the teardown lifetime races (softirq + genl).
[1] https://lore.kernel.org/netdev/20260816035205.57966-1-blbllhy@gmail.com/
Cen Zhang (Microsoft) (2): gtp: fix sk_created publication race in gtp_create_sockets() gtp: fix use-after-free during GTP device teardown
drivers/net/gtp.c | 70 ++++++++++++++++++++++++++++++++++------------- 1 file changed, 51 insertions(+), 19 deletions(-)
base-commit: b70b7b71561f2be1183b6046964d950c2b203bfc