[PATCH net v4 0/5] amt: relay tunnel lifetime, validation and request-path hardening

[Omar Ramadan <omar@blockcast.net>]

This series hardens AMT relay tunnel lifetime, validates gateway input, and
keeps unauthenticated Requests from consuming relay state. The fixes were
found while reviewing the AMT IPv6 outer transport work; that work is not
included here.

I am using the existing IPv4 AMT relay and gateway implementation in a
multicast delivery network, where gateways on access networks send IGMP/MLD
membership state through a relay to reach downstream receivers. The fixes in
this series come from exercising that deployed control and data path; the
series does not claim to add the IPv6 outer transport.

The first patch closes the gc_wq re-arm use-after-free and makes teardown
safe for RCU readers and delayed group/source workers. The second rejects
Queries and Data from 0.0.0.0 before relay discovery and revalidates deferred
Queries. The third requires exactly four bytes for IPv4 netlink address
attributes. The fourth makes pre-Query drops visible, avoids counting
successful reports as drops, and uses concurrent-safe TX statistics. The
fifth keeps Requests stateless, authenticates Membership Updates before
allocation, keys state by address and port, bounds per-source admission, and
silently drops failed endpoint admission.

v5 changes:
- Defer group/source node freeing until their delayed work is synchronously
  cancelled, with separate GC links and owner-pointer invalidation.
- Preserve the original GMI expiry for Request-only intermediate tunnels.
- Document deferred Query revalidation and rewrite the patch 5 message to
  match its authentication and admission changes.
- Move the unauthenticated Request endpoint scan out of amt->lock and remove
  the ICMP response for failed verified tunnel allocation.
- Add the tunnel liveness checks to the lifetime fix and restore the dead
  locking comment.

Validation: GCC W=1 object builds with IPv6 enabled and disabled. The full
W=1 build is blocked by an unrelated existing unused-but-set warning in
net/netfilter/nft_compat.c; the AMT object itself is warning-free.

v4: https://lore.kernel.org/netdev/20261013175407.947606-1-omar@blockcast.net/
v3: https://lore.kernel.org/netdev/20261012125943.558629-1-omar@blockcast.net/
v2: https://lore.kernel.org/netdev/20261009201455.1904698-1-omar@blockcast.net/
v1: https://lore.kernel.org/netdev/20261008003606.3666617-1-omar@blockcast.net/

Assisted-by: LLM

Omar Ramadan (5):
  amt: fix use-after-free when a Membership Update re-arms a freed
    tunnel
  amt: reject a gateway Query or Data from 0.0.0.0 before a relay is
    learned
  amt: require an exact IPv4-sized IFLA_AMT_{LOCAL,DISCOVERY}_IP
  amt: make pre-query report drops visible
  amt: harden relay authentication and teardown

 drivers/net/amt.c | 550 +++++++++++++++++++++++++++++++++++-----------
 include/net/amt.h |  31 ++-
 2 files changed, 447 insertions(+), 134 deletions(-)