[PATCH 6.6.y] gtp: disable BH before calling udp_tunnel_xmit_skb()

[PATCH 6.6.y] gtp: disable BH before calling udp_tunnel_xmit_skb()

[Ting-Han Hou]

From: David Carlier <devnexen@gmail.com>

[ Upstream commit 5638504a2aa9e1b9d72af9060df1a160cce2d379 ]

gtp_genl_send_echo_req() runs as a generic netlink doit handler in
process context with BH not disabled. It calls udp_tunnel_xmit_skb(),
which eventually invokes iptunnel_xmit() — that uses __this_cpu_inc/dec
on softnet_data.xmit.recursion to track the tunnel xmit recursion level.

Without local_bh_disable(), the task may migrate between
dev_xmit_recursion_inc() and dev_xmit_recursion_dec(), breaking the
per-CPU counter pairing. The result is stale or negative recursion
levels that can later produce false-positive
SKB_DROP_REASON_RECURSION_LIMIT drops on either CPU.

The other udp_tunnel_xmit_skb() call sites in gtp.c are unaffected:
the data path runs under ndo_start_xmit and the echo response handlers
run from the UDP encap rx softirq, both with BH already disabled.

Fix it by disabling BH around the udp_tunnel_xmit_skb() call, mirroring
commit 2cd7e6971fc2 ("sctp: disable BH before calling
udp_tunnel_xmit_skb()").

Fixes: 6f1a9140ecda ("net: add xmit recursion limit to tunnel xmit functions")
Cc: stable@vger.kernel.org
Signed-off-by: David Carlier <devnexen@gmail.com>
Link: https://patch.msgid.link/20260417055408.4667-1-devnexen@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
[ Ting-Han: this tree does not have commit e3411e326fa4 ("net: ipv4: Add a
  flags argument to iptunnel_xmit(), udp_tunnel_xmit_skb()") or commit
  1bec9d0c0046 ("ipv4: Convert ->flowi4_tos to dscp_t."), so the
  udp_tunnel_xmit_skb() call differs in context; the change is the same ]
Assisted-by: LLM
Signed-off-by: Ting-Han Hou <ue081723@gmail.com>
---
6f1a9140ecda ("net: add xmit recursion limit to tunnel xmit functions")
is in 6.6.160, so the per-CPU recursion counter it added is used from
this process-context path there too.

Build-tested on v6.6.160 (x86_64, gcc 15.2, CONFIG_GTP=m): no new W=1
or sparse warnings in drivers/net/gtp.c. Not runtime-tested: I could
not find an existing tool that sends GTP_CMD_ECHOREQ (libgtpnl does not
use it), so the echo request path itself was not exercised.

 drivers/net/gtp.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c
index f0ee46d3c873e..39515aba86e68 100644
--- a/drivers/net/gtp.c
+++ b/drivers/net/gtp.c
@@ -1827,6 +1827,7 @@ static int gtp_genl_send_echo_req(struct sk_buff *skb, struct genl_info *info)
 		return -ENODEV;
 	}
 
+	local_bh_disable();
 	udp_tunnel_xmit_skb(rt, sk, skb_to_send,
 			    fl4.saddr, fl4.daddr,
 			    fl4.flowi4_tos,
@@ -1836,6 +1837,7 @@ static int gtp_genl_send_echo_req(struct sk_buff *skb, struct genl_info *info)
 			    !net_eq(sock_net(sk),
 				    dev_net(gtp->dev)),
 			    false);
+	local_bh_enable();
 	return 0;
 }
 
-- 
2.53.0

Re: [PATCH 6.6.y] gtp: disable BH before calling udp_tunnel_xmit_skb()

[Sasha Levin]

> gtp_genl_send_echo_req() runs as a generic netlink doit handler in
> process context with BH not disabled.

Queued for 6.6, thanks.

-- 
Thanks,
Sasha