Re: [PATCH net-next] udp: properly deal with xfrm encap and ADDRFORM

[Sabrina Dubroca <sd@queasysnail.net>]

2025-04-09, 22:00:56 +0200, Paolo Abeni wrote:
> UDP GRO accounting assumes that the GRO receive callback is always
> set when the UDP tunnel is enabled, but syzkaller proved otherwise,
> leading tot the following splat:
[...]
> 
> Address the issue moving the accounting hook into
> setup_udp_tunnel_sock() and set_xfrm_gro_udp_encap_rcv(), where
> the GRO callback is actually set.
> 
> set_xfrm_gro_udp_encap_rcv() is prone to races with IPV6_ADDRFORM,
> run the relevant setsockopt under the socket lock to ensure using
> consistent values of sk_family and up->encap_type.
> 
> Refactor the GRO callback selection code, to make it clear that
> the function pointer is always initialized.
> 
> Reported-by: syzbot+8c469a2260132cd095c1@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=8c469a2260132cd095c1
> Fixes: 172bf009c18d ("xfrm: Support GRO for IPv4 ESP in UDP encapsulation")
> Fixes: 5d7f5b2f6b935 ("udp_tunnel: use static call for GRO hooks when possible")
> Signed-off-by: Paolo Abeni <pabeni@redhat.com>

Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>

-- 
Sabrina