[PATCH net-next] gtp: annotate PDP lookups under RTNL

[PATCH net-next] gtp: annotate PDP lookups under RTNL

[Runyu Xiao]

The GTP PDP lookup helpers are shared by RCU-protected data and report
paths and RTNL-protected control paths such as gtp_genl_new_pdp(). The
helpers walk RCU hlists, but they do not currently pass the RTNL
condition for the control-path lookups.

Pass lockdep_rtnl_is_held() to the PDP hlist iterators. Existing
RCU-reader callers remain valid because the RCU-list macros also accept
an active RCU read-side section; the added condition only documents the
non-RCU protection already used by RTNL control paths.

This was found by our static analysis tool and then manually reviewed
against the current tree. The dynamic triage evidence is a
target-matched CONFIG_PROVE_RCU_LIST warning; the change is limited
to documenting the existing protection contract.

This is a lockdep annotation cleanup. It does not change PDP lifetime or
hash updates.

Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
---
 drivers/net/gtp.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c
index 5cb59d72bc82..b94073c55f17 100644
--- a/drivers/net/gtp.c
+++ b/drivers/net/gtp.c
@@ -151,7 +151,8 @@ static struct pdp_ctx *gtp0_pdp_find(struct gtp_dev *gtp, u64 tid, u16 family)
 
 	head = &gtp->tid_hash[gtp0_hashfn(tid) % gtp->hash_size];
 
-	hlist_for_each_entry_rcu(pdp, head, hlist_tid) {
+	hlist_for_each_entry_rcu(pdp, head, hlist_tid,
+				 lockdep_rtnl_is_held()) {
 		if (pdp->af == family &&
 		    pdp->gtp_version == GTP_V0 &&
 		    pdp->u.v0.tid == tid)
@@ -168,7 +169,8 @@ static struct pdp_ctx *gtp1_pdp_find(struct gtp_dev *gtp, u32 tid, u16 family)
 
 	head = &gtp->tid_hash[gtp1u_hashfn(tid) % gtp->hash_size];
 
-	hlist_for_each_entry_rcu(pdp, head, hlist_tid) {
+	hlist_for_each_entry_rcu(pdp, head, hlist_tid,
+				 lockdep_rtnl_is_held()) {
 		if (pdp->af == family &&
 		    pdp->gtp_version == GTP_V1 &&
 		    pdp->u.v1.i_tei == tid)
@@ -185,7 +187,8 @@ static struct pdp_ctx *ipv4_pdp_find(struct gtp_dev *gtp, __be32 ms_addr)
 
 	head = &gtp->addr_hash[ipv4_hashfn(ms_addr) % gtp->hash_size];
 
-	hlist_for_each_entry_rcu(pdp, head, hlist_addr) {
+	hlist_for_each_entry_rcu(pdp, head, hlist_addr,
+				 lockdep_rtnl_is_held()) {
 		if (pdp->af == AF_INET &&
 		    pdp->ms.addr.s_addr == ms_addr)
 			return pdp;
@@ -220,7 +223,8 @@ static struct pdp_ctx *ipv6_pdp_find(struct gtp_dev *gtp,
 
 	head = &gtp->addr_hash[ipv6_hashfn(ms_addr) % gtp->hash_size];
 
-	hlist_for_each_entry_rcu(pdp, head, hlist_addr) {
+	hlist_for_each_entry_rcu(pdp, head, hlist_addr,
+				 lockdep_rtnl_is_held()) {
 		if (pdp->af == AF_INET6 &&
 		    ipv6_pdp_addr_equal(&pdp->ms.addr6, ms_addr))
 			return pdp;
-- 
2.34.1

Re: [PATCH net-next] gtp: annotate PDP lookups under RTNL

[Simon Horman]

On Wed, Jul 01, 2026 at 08:39:25PM +0800, Runyu Xiao wrote:
> The GTP PDP lookup helpers are shared by RCU-protected data and report
> paths and RTNL-protected control paths such as gtp_genl_new_pdp(). The
> helpers walk RCU hlists, but they do not currently pass the RTNL
> condition for the control-path lookups.
> 
> Pass lockdep_rtnl_is_held() to the PDP hlist iterators. Existing
> RCU-reader callers remain valid because the RCU-list macros also accept
> an active RCU read-side section; the added condition only documents the
> non-RCU protection already used by RTNL control paths.
> 
> This was found by our static analysis tool and then manually reviewed
> against the current tree. The dynamic triage evidence is a
> target-matched CONFIG_PROVE_RCU_LIST warning; the change is limited
> to documenting the existing protection contract.
> 
> This is a lockdep annotation cleanup. It does not change PDP lifetime or
> hash updates.
> 
> Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>

Reviewed-by: Simon Horman <horms@kernel.org>

There is an AI-generated review of this patch available on sashko.dev.
While I don't believe that the issues raised there should impede progress
of this patch you may want to look into them as possible follow-up.

...

Re: [PATCH net-next] gtp: annotate PDP lookups under RTNL

[Pablo Neira Ayuso]

Hi Simon,

On Tue, Jul 07, 2026 at 03:28:20PM +0100, Simon Horman wrote:
> On Wed, Jul 01, 2026 at 08:39:25PM +0800, Runyu Xiao wrote:
> > The GTP PDP lookup helpers are shared by RCU-protected data and report
> > paths and RTNL-protected control paths such as gtp_genl_new_pdp(). The
> > helpers walk RCU hlists, but they do not currently pass the RTNL
> > condition for the control-path lookups.
> > 
> > Pass lockdep_rtnl_is_held() to the PDP hlist iterators. Existing
> > RCU-reader callers remain valid because the RCU-list macros also accept
> > an active RCU read-side section; the added condition only documents the
> > non-RCU protection already used by RTNL control paths.
> > 
> > This was found by our static analysis tool and then manually reviewed
> > against the current tree. The dynamic triage evidence is a
> > target-matched CONFIG_PROVE_RCU_LIST warning; the change is limited
> > to documenting the existing protection contract.
> > 
> > This is a lockdep annotation cleanup. It does not change PDP lifetime or
> > hash updates.
> > 
> > Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
> 
> Reviewed-by: Simon Horman <horms@kernel.org>
> 
> There is an AI-generated review of this patch available on sashko.dev.
> While I don't believe that the issues raised there should impede progress
> of this patch you may want to look into them as possible follow-up.

This patch refers to the rtnl_lock, but it is the genetlink mutex that
protects updates on the PDP context list.

Then, from packet path, rcu lookups are performed.

I think this patch is not correct.

Re: [PATCH net-next] gtp: annotate PDP lookups under RTNL

[Simon Horman]

On Tue, Jul 07, 2026 at 04:51:12PM +0200, Pablo Neira Ayuso wrote:
> Hi Simon,
> 
> On Tue, Jul 07, 2026 at 03:28:20PM +0100, Simon Horman wrote:
> > On Wed, Jul 01, 2026 at 08:39:25PM +0800, Runyu Xiao wrote:
> > > The GTP PDP lookup helpers are shared by RCU-protected data and report
> > > paths and RTNL-protected control paths such as gtp_genl_new_pdp(). The
> > > helpers walk RCU hlists, but they do not currently pass the RTNL
> > > condition for the control-path lookups.
> > > 
> > > Pass lockdep_rtnl_is_held() to the PDP hlist iterators. Existing
> > > RCU-reader callers remain valid because the RCU-list macros also accept
> > > an active RCU read-side section; the added condition only documents the
> > > non-RCU protection already used by RTNL control paths.
> > > 
> > > This was found by our static analysis tool and then manually reviewed
> > > against the current tree. The dynamic triage evidence is a
> > > target-matched CONFIG_PROVE_RCU_LIST warning; the change is limited
> > > to documenting the existing protection contract.
> > > 
> > > This is a lockdep annotation cleanup. It does not change PDP lifetime or
> > > hash updates.
> > > 
> > > Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
> > 
> > Reviewed-by: Simon Horman <horms@kernel.org>
> > 
> > There is an AI-generated review of this patch available on sashko.dev.
> > While I don't believe that the issues raised there should impede progress
> > of this patch you may want to look into them as possible follow-up.
> 
> This patch refers to the rtnl_lock, but it is the genetlink mutex that
> protects updates on the PDP context list.
> 
> Then, from packet path, rcu lookups are performed.
> 
> I think this patch is not correct.

Hi Pablo,

Of course you are correct.
Sorry for not realising this earlier.

Re: [PATCH net-next] gtp: annotate PDP lookups under RTNL

[Paolo Abeni]

On 7/8/26 12:35 PM, Simon Horman wrote:
> On Tue, Jul 07, 2026 at 04:51:12PM +0200, Pablo Neira Ayuso wrote:
>> On Tue, Jul 07, 2026 at 03:28:20PM +0100, Simon Horman wrote:
>>> On Wed, Jul 01, 2026 at 08:39:25PM +0800, Runyu Xiao wrote:
>>>> The GTP PDP lookup helpers are shared by RCU-protected data and report
>>>> paths and RTNL-protected control paths such as gtp_genl_new_pdp(). The
>>>> helpers walk RCU hlists, but they do not currently pass the RTNL
>>>> condition for the control-path lookups.
>>>>
>>>> Pass lockdep_rtnl_is_held() to the PDP hlist iterators. Existing
>>>> RCU-reader callers remain valid because the RCU-list macros also accept
>>>> an active RCU read-side section; the added condition only documents the
>>>> non-RCU protection already used by RTNL control paths.
>>>>
>>>> This was found by our static analysis tool and then manually reviewed
>>>> against the current tree. The dynamic triage evidence is a
>>>> target-matched CONFIG_PROVE_RCU_LIST warning; the change is limited
>>>> to documenting the existing protection contract.
>>>>
>>>> This is a lockdep annotation cleanup. It does not change PDP lifetime or
>>>> hash updates.
>>>>
>>>> Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
>>>
>>> Reviewed-by: Simon Horman <horms@kernel.org>
>>>
>>> There is an AI-generated review of this patch available on sashko.dev.
>>> While I don't believe that the issues raised there should impede progress
>>> of this patch you may want to look into them as possible follow-up.
>>
>> This patch refers to the rtnl_lock, but it is the genetlink mutex that
>> protects updates on the PDP context list.
>>
>> Then, from packet path, rcu lookups are performed.
>>
>> I think this patch is not correct.
> 
> Hi Pablo,
> 
> Of course you are correct.
> Sorry for not realising this earlier.

Human slop here made me wrongly apply this patch. Could either of you
please share a formal revert?

Thanks!

Paolo

Re: [PATCH net-next] gtp: annotate PDP lookups under RTNL

[Simon Horman]

On Wed, Jul 08, 2026 at 01:10:58PM +0200, Paolo Abeni wrote:
> On 7/8/26 12:35 PM, Simon Horman wrote:
> > On Tue, Jul 07, 2026 at 04:51:12PM +0200, Pablo Neira Ayuso wrote:
> >> On Tue, Jul 07, 2026 at 03:28:20PM +0100, Simon Horman wrote:
> >>> On Wed, Jul 01, 2026 at 08:39:25PM +0800, Runyu Xiao wrote:
> >>>> The GTP PDP lookup helpers are shared by RCU-protected data and report
> >>>> paths and RTNL-protected control paths such as gtp_genl_new_pdp(). The
> >>>> helpers walk RCU hlists, but they do not currently pass the RTNL
> >>>> condition for the control-path lookups.
> >>>>
> >>>> Pass lockdep_rtnl_is_held() to the PDP hlist iterators. Existing
> >>>> RCU-reader callers remain valid because the RCU-list macros also accept
> >>>> an active RCU read-side section; the added condition only documents the
> >>>> non-RCU protection already used by RTNL control paths.
> >>>>
> >>>> This was found by our static analysis tool and then manually reviewed
> >>>> against the current tree. The dynamic triage evidence is a
> >>>> target-matched CONFIG_PROVE_RCU_LIST warning; the change is limited
> >>>> to documenting the existing protection contract.
> >>>>
> >>>> This is a lockdep annotation cleanup. It does not change PDP lifetime or
> >>>> hash updates.
> >>>>
> >>>> Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
> >>>
> >>> Reviewed-by: Simon Horman <horms@kernel.org>
> >>>
> >>> There is an AI-generated review of this patch available on sashko.dev.
> >>> While I don't believe that the issues raised there should impede progress
> >>> of this patch you may want to look into them as possible follow-up.
> >>
> >> This patch refers to the rtnl_lock, but it is the genetlink mutex that
> >> protects updates on the PDP context list.
> >>
> >> Then, from packet path, rcu lookups are performed.
> >>
> >> I think this patch is not correct.
> > 
> > Hi Pablo,
> > 
> > Of course you are correct.
> > Sorry for not realising this earlier.
> 
> Human slop here made me wrongly apply this patch. Could either of you
> please share a formal revert?

Sure, will do.

Re: [PATCH net-next] gtp: annotate PDP lookups under RTNL

[Simon Horman]

On Wed, Jul 08, 2026 at 07:32:52PM +0100, Simon Horman wrote:
> On Wed, Jul 08, 2026 at 01:10:58PM +0200, Paolo Abeni wrote:
> > On 7/8/26 12:35 PM, Simon Horman wrote:
> > > On Tue, Jul 07, 2026 at 04:51:12PM +0200, Pablo Neira Ayuso wrote:

...

> > >> I think this patch is not correct.
> > > 
> > > Hi Pablo,
> > > 
> > > Of course you are correct.
> > > Sorry for not realising this earlier.
> > 
> > Human slop here made me wrongly apply this patch. Could either of you
> > please share a formal revert?
> 
> Sure, will do.

- [PATCH net-next] Revert "gtp: annotate PDP lookups under RTNL"
  https://lore.kernel.org/netdev/20260708-gtp-rtnl-v1-1-218091f171bc@kernel.org/T/

Re: [PATCH net-next] gtp: annotate PDP lookups under RTNL

[Paolo Abeni]

On 7/8/26 9:04 PM, Simon Horman wrote:
> On Wed, Jul 08, 2026 at 07:32:52PM +0100, Simon Horman wrote:
>> On Wed, Jul 08, 2026 at 01:10:58PM +0200, Paolo Abeni wrote:
>>> On 7/8/26 12:35 PM, Simon Horman wrote:
>>>> On Tue, Jul 07, 2026 at 04:51:12PM +0200, Pablo Neira Ayuso wrote:
> 
> ...
> 
>>>>> I think this patch is not correct.
>>>>
>>>> Hi Pablo,
>>>>
>>>> Of course you are correct.
>>>> Sorry for not realising this earlier.
>>>
>>> Human slop here made me wrongly apply this patch. Could either of you
>>> please share a formal revert?
>>
>> Sure, will do.
> 
> - [PATCH net-next] Revert "gtp: annotate PDP lookups under RTNL"
>   https://lore.kernel.org/netdev/20260708-gtp-rtnl-v1-1-218091f171bc@kernel.org/T/

Thanks Simon!

/P

Re: [PATCH net-next] gtp: annotate PDP lookups under RTNL

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net-next.git (main)
by Paolo Abeni <pabeni@redhat.com>:

On Wed,  1 Jul 2026 20:39:25 +0800 you wrote:
> The GTP PDP lookup helpers are shared by RCU-protected data and report
> paths and RTNL-protected control paths such as gtp_genl_new_pdp(). The
> helpers walk RCU hlists, but they do not currently pass the RTNL
> condition for the control-path lookups.
> 
> Pass lockdep_rtnl_is_held() to the PDP hlist iterators. Existing
> RCU-reader callers remain valid because the RCU-list macros also accept
> an active RCU read-side section; the added condition only documents the
> non-RCU protection already used by RTNL control paths.
> 
> [...]

Here is the summary with links:
  - [net-next] gtp: annotate PDP lookups under RTNL
    https://git.kernel.org/netdev/net-next/c/0be5c3f0fbef

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html

Re: [PATCH net-next] gtp: annotate PDP lookups under RTNL

[Pablo Neira Ayuso]

Hi,

On Wed, Jul 08, 2026 at 08:20:09AM +0000, patchwork-bot+netdevbpf@kernel.org wrote:
> Hello:
> 
> This patch was applied to netdev/net-next.git (main)
> by Paolo Abeni <pabeni@redhat.com>:
> 
> On Wed,  1 Jul 2026 20:39:25 +0800 you wrote:
> > The GTP PDP lookup helpers are shared by RCU-protected data and report
> > paths and RTNL-protected control paths such as gtp_genl_new_pdp(). The
> > helpers walk RCU hlists, but they do not currently pass the RTNL
> > condition for the control-path lookups.
> > 
> > Pass lockdep_rtnl_is_held() to the PDP hlist iterators. Existing
> > RCU-reader callers remain valid because the RCU-list macros also accept
> > an active RCU read-side section; the added condition only documents the
> > non-RCU protection already used by RTNL control paths.
> > 
> > [...]
> 
> Here is the summary with links:
>   - [net-next] gtp: annotate PDP lookups under RTNL
>     https://git.kernel.org/netdev/net-next/c/0be5c3f0fbef

For the record, I think this patch was not OK.

PDP context hashtable is protected by the genl_mutex, not rtnl.

If I'm mistaken, please let know, thanks!