From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f43.google.com (mail-wm1-f43.google.com [209.85.128.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 61A173264D0 for ; Fri, 17 Apr 2026 05:54:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.43 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776405254; cv=none; b=ECuhed8+/9eHyLSpk3haiGg4IrkrU7JIV2LOfJNoOO+y9BH+8unq6IV2wViuTfT1XKLjFMv1TisLSL+dXiYKZhuXs9z+B4TMuXegLiMjEZqdl5n4ltim1otDrJwcpNU6+PXYQ/UKZetYMLG+kNA60EavZBz24FOo1T5bdkz2uGA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776405254; c=relaxed/simple; bh=ZPVoDRVg5qdPPlFaadv6E/ZkAG3Lq7FAW7jz2H11nco=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version:Content-Type; b=clzkzYGFLpgqnZ98/DGyzKkpo82tdKk3V4KN2ia/89VDYcKRL/IMtmosmk+Aiy62/DnLC26fKfXPFQFRFZjQ6rbZBSSM7rcAGaPPIoeOjLtmrcEZoVEdvthygUy+yzfuunZShkt0N71qCxmPje7sq5x5aQiIR9ebUQ4LmeJqttk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=dU5p9g4y; arc=none smtp.client-ip=209.85.128.43 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="dU5p9g4y" Received: by mail-wm1-f43.google.com with SMTP id 5b1f17b1804b1-488ba840146so2551365e9.1 for ; Thu, 16 Apr 2026 22:54:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1776405252; x=1777010052; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=FI4aNMoH9LEGA5ZaunJU6TNqTpv8Ar0cTiNa6gwkLx0=; b=dU5p9g4yTLVz7u2/Exy32txOaWb7TyvQ8EPL3f3AyzSarc4YAcr/Q7M7JXKByXOglW cH3ZCi+PkwHJT/f0+gPqoZBWC6C+zez/XgSyKqHNP++hyXLIyvQjHWPatbfeBzgfUnOq 14l5EBde5cFGnkieja5PxNXxjfaFIyw0Pr7tCOU4/q74YC37xYei1pwqJ8P2/uzFpxdY k8r3D/vuN2ydQbzJnfJgkzTc56e9hp79qJ5Q5oxefQA73isBmMHDv5FXyyQoN6LUBFi1 DWoDtaHlVJfgEI2fdT5ujhJnwKlsphRWTENiX1wSH/iDgsqFpZiZJLCt84cWKVVGa0lw GYLA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1776405252; x=1777010052; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=FI4aNMoH9LEGA5ZaunJU6TNqTpv8Ar0cTiNa6gwkLx0=; b=sCJs9ilxwGvU9xphIfM1jQ9jeEwgBUwehmWRjTF6PWbTZqVbNYzWnOFa4g3tc7KSNS 8n0njTtjYMpUceKdBo8G3W0+iXtu0NCzSgMvQKj/7SNyi2SGZ5Q/K+4kaGm6zCQVu63a yW+629mK9JN8I56rNYyEU6iKPhQ4IbUErXG7JjGc5bkx9HPc25O1gQS+/fEhJ+agAPpD Ky987Hf/LIFwUD7cyyCbm7n/XGqhy8vPVIXs6TBRc5u9Zy8ORwcJQhtCdih4TE4R9Vwg ZvvB2asPDVegIJbsNHB9CxYrhYqbsTWNSIFBPvxtyXOJZL4C3/3qk7ujRzL3fgrfCCUd 8keg== X-Forwarded-Encrypted: i=1; AFNElJ+io3C18WsX62PUm5rVNLtkobiYQiRvnEQn7lBiQGsxn7yyvK//kABWtb8ADaNraDrss9Y1+5LG2akrK+I=@vger.kernel.org X-Gm-Message-State: AOJu0Ywd6aXqx4lT50xXHUXStaJdnSwGhWMqkvB2i7jB2+liEXq3kART baSHFOIXU1vmG9ot8EysbjiNtdFShB3NAm/QddS6yQjLF1BpfBXMDLPo X-Gm-Gg: AeBDievBV/EmJKcyx/p9hjDJHdOzj/2/owRHAeFtjJHovxjuVDkBCMs5GolQJB71OXF d4ii6dMRLB8dWsMBH9eiMvsadjeiBCS4f9uhFfMUQ2G4YF+VVTuz9DEsFPZmGouq9gQj0QLYGns 9xAz6HWruDO3FEjGZpz76MWtcszlnSBMM4We91S7gnMWnYju4WjK1DzoRU7Ymm6H9KpL7oMtUNF PHAquJaqTFONQoaSYriWyQBzrS+1KE0e1ZDYFC/U/zk1JfQ+LKNqyYpLhwJ93wYD0kZHonclxyh +j/9S6ZBpul8n8krVr3gAPyXuIbpfJBhBr6Qn284xBNf/XpyQjmuUdLr/YrJC5YJQ/MYUpwjYgq I7elLAi6n+JrpB4TgVKDGxiiiqboguYnx5XgbIJk2BrkKlMPiPd+y6sRzZ21WCo+YcvVBOhdCKL l1vVvP969BqfzsgdUdf2TNx+IrxlKmOsCE6UBFfqVn3RcHos3E5qyYnm7ycaM7BkFm4yOTtU+Oz QLEzGXHk7WRf7a/q+oiFQ== X-Received: by 2002:a05:600c:8115:b0:488:904b:f31 with SMTP id 5b1f17b1804b1-488fb77e27cmr16466985e9.22.1776405251618; Thu, 16 Apr 2026 22:54:11 -0700 (PDT) Received: from dohko.chello.ie (188-141-5-72.dynamic.upc.ie. [188.141.5.72]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-488fc1c96b4sm27246775e9.13.2026.04.16.22.54.10 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 16 Apr 2026 22:54:11 -0700 (PDT) From: David Carlier To: Pablo Neira Ayuso , Harald Welte , Andrew Lunn , Eric Dumazet , Jakub Kicinski , Paolo Abeni Cc: Weiming Shi , osmocom-net-gprs@lists.osmocom.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, David Carlier , stable@vger.kernel.org Subject: [PATCH] gtp: disable BH before calling udp_tunnel_xmit_skb() Date: Fri, 17 Apr 2026 06:54:08 +0100 Message-ID: <20260417055408.4667-1-devnexen@gmail.com> X-Mailer: git-send-email 2.53.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit gtp_genl_send_echo_req() runs as a generic netlink doit handler in process context with BH not disabled. It calls udp_tunnel_xmit_skb(), which eventually invokes iptunnel_xmit() — that uses __this_cpu_inc/dec on softnet_data.xmit.recursion to track the tunnel xmit recursion level. Without local_bh_disable(), the task may migrate between dev_xmit_recursion_inc() and dev_xmit_recursion_dec(), breaking the per-CPU counter pairing. The result is stale or negative recursion levels that can later produce false-positive SKB_DROP_REASON_RECURSION_LIMIT drops on either CPU. The other udp_tunnel_xmit_skb() call sites in gtp.c are unaffected: the data path runs under ndo_start_xmit and the echo response handlers run from the UDP encap rx softirq, both with BH already disabled. Fix it by disabling BH around the udp_tunnel_xmit_skb() call, mirroring commit 2cd7e6971fc2 ("sctp: disable BH before calling udp_tunnel_xmit_skb()"). Fixes: 6f1a9140ecda ("net: add xmit recursion limit to tunnel xmit functions") Cc: stable@vger.kernel.org Signed-off-by: David Carlier --- drivers/net/gtp.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c index 70b9e58b9b78..5150f2e4f66b 100644 --- a/drivers/net/gtp.c +++ b/drivers/net/gtp.c @@ -2400,6 +2400,7 @@ static int gtp_genl_send_echo_req(struct sk_buff *skb, struct genl_info *info) return -ENODEV; } + local_bh_disable(); udp_tunnel_xmit_skb(rt, sk, skb_to_send, fl4.saddr, fl4.daddr, inet_dscp_to_dsfield(fl4.flowi4_dscp), @@ -2409,6 +2410,7 @@ static int gtp_genl_send_echo_req(struct sk_buff *skb, struct genl_info *info) !net_eq(sock_net(sk), dev_net(gtp->dev)), false, 0); + local_bh_enable(); return 0; } -- 2.53.0