[PATCH net] gtp: free the skb after handling an echo response

[PATCH net] gtp: free the skb after handling an echo response

[Joas Antonio dos Santos via B4 Relay]

From: Joas Antonio dos Santos <joasantonio108@gmail.com>

gtp0_handle_echo_resp() and gtp1u_handle_echo_resp() return the result
of genlmsg_multicast_netns() to gtp_encap_recv().  When the netlink
notification is delivered that result is 0, and gtp_encap_recv() treats
0 as "the skb has been consumed":

	switch (ret) {
	case 1:
		netdev_dbg(gtp->dev, "pass up to the process\n");
		break;
	case 0:
		break;
	case -1:
		netdev_dbg(gtp->dev, "GTP packet has been dropped\n");
		kfree_skb(skb);
		ret = 0;
		break;
	}

The echo response handlers only read from the skb and never free it or
pass it on, so every echo response that is reported to a listener on the
gtp multicast group leaks the skb.  Echo responses are handled for any
peer when the UDP sockets were created by the kernel, so a remote host
can leak memory on the receiver by sending GTP echo responses while a
process with CAP_NET_ADMIN is subscribed to the gtp multicast group, for
example a daemon that monitors echo responses.

The error paths do not leak but have a related problem.  -ENOMEM and the error from
genlmsg_multicast_netns() (-ESRCH when nobody listens) are not -1, so
they are returned unchanged to the UDP stack, which takes a negative
value from encap_rcv() as a request to resubmit the packet to the
protocol with that number.

Return -1 when the notification cannot be built, so that
gtp_encap_recv() drops the skb, and consume the skb once the
notification has been handed to netlink, whether or not anybody is
listening.

Found by LLM-assisted source review.

Fixes: d33bd757d362 ("gtp: Implement GTP echo request")
Cc: stable@vger.kernel.org
Signed-off-by: Joas Antonio dos Santos <joasantonio108@gmail.com>
---
This issue was found with the help of an LLM-based code review tool
(Claude).  I checked the code paths by hand against v7.4-rc3 and
reviewed the fix myself.  It is build-tested only (W=1, arm64); I do
not have the hardware to test it at runtime.
---
 drivers/net/gtp.c | 22 ++++++++++++++--------
 1 file changed, 14 insertions(+), 8 deletions(-)

diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c
index 1dd32e979cf5..85d1b0c46ecf 100644
--- a/drivers/net/gtp.c
+++ b/drivers/net/gtp.c
@@ -561,16 +561,19 @@ static int gtp0_handle_echo_resp(struct gtp_dev *gtp, struct sk_buff *skb)
 
 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
 	if (!msg)
-		return -ENOMEM;
+		return -1;
 
 	ret = gtp_genl_fill_echo(msg, 0, 0, 0, GTP_CMD_ECHOREQ, echo);
 	if (ret < 0) {
 		nlmsg_free(msg);
-		return ret;
+		return -1;
 	}
 
-	return genlmsg_multicast_netns(&gtp_genl_family, dev_net(gtp->dev),
-				       msg, 0, GTP_GENL_MCGRP, GFP_ATOMIC);
+	genlmsg_multicast_netns(&gtp_genl_family, dev_net(gtp->dev),
+				msg, 0, GTP_GENL_MCGRP, GFP_ATOMIC);
+	consume_skb(skb);
+
+	return 0;
 }
 
 static int gtp_proto_to_family(__u16 proto)
@@ -748,16 +751,19 @@ static int gtp1u_handle_echo_resp(struct gtp_dev *gtp, struct sk_buff *skb)
 
 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
 	if (!msg)
-		return -ENOMEM;
+		return -1;
 
 	ret = gtp_genl_fill_echo(msg, 0, 0, 0, GTP_CMD_ECHOREQ, echo);
 	if (ret < 0) {
 		nlmsg_free(msg);
-		return ret;
+		return -1;
 	}
 
-	return genlmsg_multicast_netns(&gtp_genl_family, dev_net(gtp->dev),
-				       msg, 0, GTP_GENL_MCGRP, GFP_ATOMIC);
+	genlmsg_multicast_netns(&gtp_genl_family, dev_net(gtp->dev),
+				msg, 0, GTP_GENL_MCGRP, GFP_ATOMIC);
+	consume_skb(skb);
+
+	return 0;
 }
 
 static int gtp_parse_exthdrs(struct sk_buff *skb, unsigned int *hdrlen)

---
base-commit: b3dfbde62cf1981c4638939c159dfd087b7a72e9
change-id: 20261110-gtp-echo-rsp-leak-7a3fac62bd3c

Best regards,
-- 
Joas Antonio dos Santos <joasantonio108@gmail.com>

Re: [PATCH net] gtp: free the skb after handling an echo response

[Markus Elfring]

…
> +++ b/drivers/net/gtp.c
> @@ -561,16 +561,19 @@ static int gtp0_handle_echo_resp(struct gtp_dev *gtp, struct sk_buff *skb)
…
> -	return genlmsg_multicast_netns(&gtp_genl_family, dev_net(gtp->dev),
> -				       msg, 0, GTP_GENL_MCGRP, GFP_ATOMIC);
> +	genlmsg_multicast_netns(&gtp_genl_family, dev_net(gtp->dev),
> +				msg, 0, GTP_GENL_MCGRP, GFP_ATOMIC);
> +	consume_skb(skb);
> +
> +	return 0;
>  }
…

I suggest to reconsider the error detection a bit more.
https://elixir.bootlin.com/linux/v7.3.1/source/drivers/net/gtp.c#L541-L573
https://cwe.mitre.org/data/definitions/252.html

Regards,
Markus

Re: [PATCH net] gtp: free the skb after handling an echo response

[Joas Antonio]

> I suggest to reconsider the error detection a bit more.
> https://elixir.bootlin.com/linux/v7.3.1/source/drivers/net/gtp.c#L541-L573
> https://cwe.mitre.org/data/definitions/252.html

Hi Markus,

thanks for looking at the patch.

Dropping the return value of genlmsg_multicast_netns() is intentional
here.  At that point the echo response has been parsed and the
notification has been handed to netlink, which owns and frees msg on
every path.  The only thing left for the handler to do is to release
the received skb, and that is the same whether the notification
reached a listener or not.

The failures that can come back are -ESRCH (nobody is subscribed to
the group) and -ENOBUFS (a listener's receive queue is full).  Neither
is a receive error for the GTP packet, and there is no recovery to
attempt.  Passing them on is what the current code does, and it is the
second problem described in the commit message: gtp_encap_recv() only
knows 1, 0 and -1, so any other negative value goes back to the UDP
stack, which treats it as a request to resubmit the packet to another
protocol.

The errors that the handler can act on, nlmsg_new() and
gtp_genl_fill_echo() failing, are still detected and now return -1 so
that the skb is dropped.

Regards,
Joas

Em ter., 10 de nov. de 2026 às 10:08, Markus Elfring
<Markus.Elfring@web.de> escreveu:
>
> …
> > +++ b/drivers/net/gtp.c
> > @@ -561,16 +561,19 @@ static int gtp0_handle_echo_resp(struct gtp_dev *gtp, struct sk_buff *skb)
> …
> > -     return genlmsg_multicast_netns(&gtp_genl_family, dev_net(gtp->dev),
> > -                                    msg, 0, GTP_GENL_MCGRP, GFP_ATOMIC);
> > +     genlmsg_multicast_netns(&gtp_genl_family, dev_net(gtp->dev),
> > +                             msg, 0, GTP_GENL_MCGRP, GFP_ATOMIC);
> > +     consume_skb(skb);
> > +
> > +     return 0;
> >  }
> …
>
> I suggest to reconsider the error detection a bit more.
> https://elixir.bootlin.com/linux/v7.3.1/source/drivers/net/gtp.c#L541-L573
> https://cwe.mitre.org/data/definitions/252.html
>
> Regards,
> Markus



-- 
Joas Antonio dos Santos
Cyber Security Specialist and Ethical Hacker
joasantonio108@gmail.com
LinkedIn

Re: [PATCH net] gtp: free the skb after handling an echo response

[Jakub Kicinski]

On Tue, 10 Nov 2026 09:03:26 +0000 Joas Antonio dos Santos via B4 Relay
wrote:
> I do not have the hardware to test it at runtime.

What HW? Isn't this a SW driver?

Re: [PATCH net] gtp: free the skb after handling an echo response

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Tue, 10 Nov 2026 09:03:26 +0000 you wrote:
> From: Joas Antonio dos Santos <joasantonio108@gmail.com>
> 
> gtp0_handle_echo_resp() and gtp1u_handle_echo_resp() return the result
> of genlmsg_multicast_netns() to gtp_encap_recv().  When the netlink
> notification is delivered that result is 0, and gtp_encap_recv() treats
> 0 as "the skb has been consumed":
> 
> [...]

Here is the summary with links:
  - [net] gtp: free the skb after handling an echo response
    https://git.kernel.org/netdev/net/c/f17b293d155f

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html