[PATCH v2 net 0/3] net: udp_tunnel: fix races and use-after-free

[Eric Dumazet <edumazet@google.com>]

Yue Sun reported a use-after-free and debugobjects warning in
udp_tunnel_nic_device_sync_work() when concurrently creating and
destroying netdevsim and geneve devices.

This series resolves the UAF and the underlying data races that
make the fix vulnerable.

The core issue is a workqueue re-queue race combined with data races
introduced by the lock-splitting in commit 1ead7501094c ("udp_tunnel:
remove rtnl_lock dependency"). That commit allowed the device reset
path (reset_ntf) to run without holding the RTNL lock (using only
utn->lock), while the port addition paths (add_port) still run under
RTNL without acquiring utn->lock.

This series fixes these issues in three steps:

1. Patch 1 (Jakub's fix) addresses the UAF by preventing double-queueing
   of the sync work. If work_pending is already set, we return early
   in device_sync(), blocking a second work item from entering the
   queue while the first is blocked on RTNL.

2. Patch 2 converts the state flags (need_sync, need_replay, work_pending)
   from bitfields to atomic bitops. Because these flags share a single
   byte, concurrent RMW writes from the RTNL-locked path and the RTNL-less
   reset path corrupt the byte. This corruption could clear work_pending,
   defeating the UAF fix.

3. Patch 3 fixes a similar data race on the 'missed' bitmap. Writes
   (__set_bit) happen under RTNL, while reads (should_replay) happen
   under utn->lock without RTNL. We convert this to use atomic set_bit(),
   READ_ONCE() for the fast-path read, and WRITE_ONCE() for clearing.

Reported-by: Yue Sun <samsun1006219@gmail.com>

Eric Dumazet (3):
  net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync
  net: udp_tunnel: convert state flags to atomic bitops
  net: udp_tunnel: use atomic bitops for missed bitmap

 net/ipv4/udp_tunnel_nic.c | 51 +++++++++++++++++++++------------------
 1 file changed, 28 insertions(+), 23 deletions(-)

-- 
2.55.0.rc0.799.gd6f94ed593-goog