[PATCH net v2 1/2] gtp: fix sk_created publication race in gtp_create_sockets()

["Cen Zhang (Microsoft)" <blbllhy@gmail.com>]

In gtp_create_sockets(), gtp->sk_created is set to true before gtp->sk0
and gtp->sk1u are assigned. Without memory ordering guarantees, a
concurrent GTP Echo packet on another CPU can observe sk_created == true
while gtp->sk0 is still NULL, causing a kernel panic.

  KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
  RIP: 0010:gtp_encap_recv  (drivers/net/gtp.c:542 gtp0_handle_echo_resp)
  Call Trace:
   <IRQ>
   udp_queue_rcv_one_skb
   ip_protocol_deliver_rcu
   ip_local_deliver
  Kernel panic - not syncing: Fatal exception in interrupt

Use smp_store_release() when publishing sk_created and
smp_load_acquire() on every lockless read. This ensures that all prior
stores (sk0, sk1u assignments) are visible before any reader can observe
the flag as true, on all architectures. Annotate all remaining lockless
sk_created accesses with smp_store_release()/smp_load_acquire().

Suggested-by: Simon Horman <horms@kernel.org>
Fixes: b20dc3c68458 ("gtp: Allow to create GTP device without FDs")
Reported-by: AutonomousCodeSecurity@microsoft.com
Reported-by: Xiang Mei (Microsoft) <xmei5@asu.edu>
Reported-by: Cen Zhang (Microsoft) <blbllhy@gmail.com>
Signed-off-by: Cen Zhang (Microsoft) <blbllhy@gmail.com>
---
v2: Use smp_store_release()/smp_load_acquire() to provide proper memory
    ordering as suggested by Simon Horman.
v1: https://lore.kernel.org/netdev/20260816035205.57966-1-blbllhy@gmail.com/
---
 drivers/net/gtp.c | 29 ++++++++++++++++++++++-------
 1 file changed, 22 insertions(+), 7 deletions(-)

diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c
index 298efc76a56b..ead519ee18d1 100644
--- a/drivers/net/gtp.c
+++ b/drivers/net/gtp.c
@@ -603,10 +603,12 @@ static int gtp0_udp_encap_recv(struct gtp_dev *gtp, struct sk_buff *skb)
 	 * there is no daemon running in userspace which would
 	 * handle echo request.
 	 */
-	if (gtp0->type == GTP_ECHO_REQ && gtp->sk_created)
+	/* Pairs with smp_store_release() in gtp_create_sockets(). */
+	if (gtp0->type == GTP_ECHO_REQ && smp_load_acquire(&gtp->sk_created))
 		return gtp0_send_echo_resp(gtp, skb);
 
-	if (gtp0->type == GTP_ECHO_RSP && gtp->sk_created)
+	/* Pairs with smp_store_release() in gtp_create_sockets(). */
+	if (gtp0->type == GTP_ECHO_RSP && smp_load_acquire(&gtp->sk_created))
 		return gtp0_handle_echo_resp(gtp, skb);
 
 	if (gtp0->type != GTP_TPDU)
@@ -811,10 +813,12 @@ static int gtp1u_udp_encap_recv(struct gtp_dev *gtp, struct sk_buff *skb)
 	 * there is no daemon running in userspace which would
 	 * handle echo request.
 	 */
-	if (gtp1->type == GTP_ECHO_REQ && gtp->sk_created)
+	/* Pairs with smp_store_release() in gtp_create_sockets(). */
+	if (gtp1->type == GTP_ECHO_REQ && smp_load_acquire(&gtp->sk_created))
 		return gtp1u_send_echo_resp(gtp, skb);
 
-	if (gtp1->type == GTP_ECHO_RSP && gtp->sk_created)
+	/* Pairs with smp_store_release() in gtp_create_sockets(). */
+	if (gtp1->type == GTP_ECHO_RSP && smp_load_acquire(&gtp->sk_created))
 		return gtp1u_handle_echo_resp(gtp, skb);
 
 	if (gtp1->type != GTP_TPDU)
@@ -894,7 +898,10 @@ static void gtp_encap_disable(struct gtp_dev *gtp)
 	if (gtp->sk_created) {
 		udp_tunnel_sock_release(gtp->sk0);
 		udp_tunnel_sock_release(gtp->sk1u);
-		gtp->sk_created = false;
+		/* Pairs with smp_load_acquire() in the RX and
+		 * genl echo paths.
+		 */
+		smp_store_release(&gtp->sk_created, false);
 		gtp->sk0 = NULL;
 		gtp->sk1u = NULL;
 	} else {
@@ -1462,10 +1469,15 @@ static int gtp_create_sockets(struct gtp_dev *gtp, const struct nlattr *nla,
 		return PTR_ERR(sk1u);
 	}
 
-	gtp->sk_created = true;
 	gtp->sk0 = sk0;
 	gtp->sk1u = sk1u;
 
+	/* Ensure sk0/sk1u are visible before sk_created is set.
+	 * Pairs with smp_load_acquire() in the RX and genl
+	 * echo paths.
+	 */
+	smp_store_release(&gtp->sk_created, true);
+
 	return 0;
 }
 
@@ -2365,7 +2377,10 @@ static int gtp_genl_send_echo_req(struct sk_buff *skb, struct genl_info *info)
 	if (!gtp)
 		return -ENODEV;
 
-	if (!gtp->sk_created)
+	/* Pairs with smp_store_release() in gtp_create_sockets()
+	 * and gtp_encap_disable().
+	 */
+	if (!smp_load_acquire(&gtp->sk_created))
 		return -EOPNOTSUPP;
 	if (!(gtp->dev->flags & IFF_UP))
 		return -ENETDOWN;
-- 
2.55.0