From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-yw1-f169.google.com (mail-yw1-f169.google.com [209.85.128.169]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D1F752E1722 for ; Tue, 25 Aug 2026 05:24:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.169 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787635449; cv=none; b=RqCLN7Qpo7VVKpdS+7OZ3paWCrsywwHufaKB8NVTRUM15zPipmpQHJPeo2Cdy18vs5RmEqMS04TDFRue+oJUsAt78JAf3QA6vX2CuJc484QMBzRF/huA2D1eeLD0c8ywJTcDMEAyEXKx5uJhofdKx6k4jPQNA6hbTUrFYoOLhvU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787635449; c=relaxed/simple; bh=vFMdJUTX48W+PQPCib0IiR4x6GCAZloV0OXbgVN5BYc=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=UlmAQTeGB1DLvZ/jGKj/HOYgOgmG+4gQoVz6cfw8YUmjfOxQdZM9IOIwxAlZzIXOXWCWXduJGrtqEmyW94/2S6XtMoR6m9ToJWAq3XqyDVoJwVZI/Ix80KFp1RTQ/o2O4pcNKqsbCzKjp1IjPc0iTwAbeIoszg/Q+mYw9Jlqy1w= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=NjCLG8I+; arc=none smtp.client-ip=209.85.128.169 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="NjCLG8I+" Received: by mail-yw1-f169.google.com with SMTP id 00721157ae682-836cb2fa1bcso65831807b3.1 for ; Mon, 24 Aug 2026 22:24:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1787635447; x=1788240247; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=2mJP8TqsrYYGzuYn0yP6OFVeMmAR8CqjeqnEz91itww=; b=NjCLG8I+7hDGy+ln72orAnOk5l8BvvG6D7hFiawvNZlA59lwjx+B40APc1ceLxQewS wPqaQg3Jwbqx5ynnqW54OHD22PcJvKMXs4IPIJf5u0H7qocBTsLy0PbVh9f8Nmm0p1NL ww7VOZDeFfcFnXBqLAEm0XcaNBOei2jH38e3Gm87H2sucZAsXayarRRY+Vl/8dU9FD8+ 7HExjCVJ66gHGdIE7E9zhNPNhVNeXNLiv0ocnLp79Y/WPQHwUBb1GmhwCQtuvG16OZZL 2tcmJqmwdxSP/VNPszslAtGytxBoqmQkfLpmUBIkwazGJtJ9rDaRRVFYVFXqEd2nNtoW 6h5Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787635447; x=1788240247; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=2mJP8TqsrYYGzuYn0yP6OFVeMmAR8CqjeqnEz91itww=; b=ROOADHYYklTUBL6V5rgwH9fg1Rnn99jEO/qDpCf84QYj0qo+aJ3vLp/ndjymSAQG8S Jv+CuFBEjCuebDadBrh1nBmL2zhoay35j2zFDAY+GwXVd2a9JSueNOCbdu2UE/yrhJcR dzNUxzPGwjKoSEyGosriqo7YIz/S/rxD/DU61uKYqQ7MfkuXaG67/Kq3rPIbexwfpEN6 CWfKLvaoWf1vEPtBy3Y3Zq8vLOhGhLJqkxXEfsu21AJ4bXkZZybeFse0Q338FGl4/bUJ vUxQU7F11ZXFnSrJR7rLFu/KfiwyHwIaS2FNc0AHYnc4KJZaHTEi3jGJwy/pvyfg9xTy sjAw== X-Forwarded-Encrypted: i=1; AHgh+RrsWSzrsLkEVru/rwa01ySif0pFFw8pGiZPAYjRBvM0qljD/tGCa/mi+xkEwwXOrkvWpwexqgH44bvAwMs=@vger.kernel.org X-Gm-Message-State: AFuF++lvLGwhfLk8ZOzsj2y/EPaengtp1gaXBs0eh0EfLidJYEVUOji7 gC2Xp+vTyJaUA1GxmGsE4o9dZCTnkGTjS0tFcTsttVmmAsWAeblzlZm9 X-Gm-Gg: AR+sD13RYbkc8GY2t3Aiq/RZboP284aHUi5XqJ7r7Lc6TWRdLt93SZNhphC5uz7+I2R AQ75j1wZAzYV9HF/OefBi+hjmPuI4X0gLdaQ5Z7+EaxlwbTVpue29hN2umHh3qmdClNl4Aa0lFU +oaWwQOluf8nu7qtHUClgwdzaFrOAiiYvEoxg5u7ORRZ8A8ifOlWB6X/WTKfabN2VRKqHP0ZEw5 ASFP3TQHlSDKlRhf5kLZHAp43NSfm+qCHE+80f9tMkgCkMaHxXV7aj+rs4S6kSUu60dqKccNnXl 0aHf1xV4o3ZNyiBno2+BvMVzWlyqJJ/bsCqd40BZQq372cIhL3I5b+BeiCoCgkPFRCyPS3eb30Z u4EZXvcOKreJ0qTnM1baFpx9tWS0UmT1ka53nNEgBd3T/Uq2nj4m4YNRiH3IFfmpMQD3dNfmLXs IBxjdse9com40J7E4iPfV1t9duDexILHwi1DXIewlIn6CPKDkhhz0EwPkt3963MBkCHDE= X-Received: by 2002:a05:690c:398:b0:815:bc6a:2e48 with SMTP id 00721157ae682-84c97c883fcmr102058037b3.14.1787635446827; Mon, 24 Aug 2026 22:24:06 -0700 (PDT) Received: from mac.lan ([136.55.173.105]) by smtp.gmail.com with ESMTPSA id 00721157ae682-851e1419e0bsm21767747b3.26.2026.08.24.22.24.06 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Mon, 24 Aug 2026 22:24:06 -0700 (PDT) From: "Cen Zhang (Microsoft)" To: pablo@netfilter.org, laforge@gnumonks.org, andrew+netdev@lunn.ch, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com Cc: horms@kernel.org, anthony.l.nguyen@intel.com, wojciech.drewek@intel.com, osmocom-net-gprs@lists.osmocom.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, AutonomousCodeSecurity@microsoft.com, xmei5@asu.edu, tgopinath@linux.microsoft.com, kys@microsoft.com, blbllhy@gmail.com Subject: [PATCH net v2 0/2] gtp: fix sk_created race conditions Date: Tue, 25 Aug 2026 01:24:02 -0400 Message-ID: <20260825052404.45665-1-blbllhy@gmail.com> X-Mailer: git-send-email 2.55.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Two races exist around the sk_created flag in the GTP driver: an initialization ordering issue where sk_created is published before the socket pointers are assigned, and a teardown lifetime issue where concurrent readers can still use the sockets after they are freed. They are split into separate patches because they require fundamentally different fixes -- memory barriers for ordering vs synchronize_net() and RTNL for lifetime. Changes since v1 [1]: - Use smp_store_release()/smp_load_acquire() for proper memory ordering as suggested by Simon Horman. - Add patch 2/2 to fix teardown races in gtp_encap_disable(): reorder to clear sk_created first, add synchronize_net() for softirq paths, and hold RTNL in gtp_genl_send_echo_req() for the process-context path that synchronize_net() cannot protect. Patch 1/2 fixes the initialization ordering race. Patch 2/2 fixes the teardown lifetime races (softirq + genl). [1] https://lore.kernel.org/netdev/20260816035205.57966-1-blbllhy@gmail.com/ Cen Zhang (Microsoft) (2): gtp: fix sk_created publication race in gtp_create_sockets() gtp: fix use-after-free during GTP device teardown drivers/net/gtp.c | 70 ++++++++++++++++++++++++++++++++++------------- 1 file changed, 51 insertions(+), 19 deletions(-) base-commit: b70b7b71561f2be1183b6046964d950c2b203bfc -- 2.55.0