[PATCH 6.1.y] gtp: disable BH before calling udp_tunnel_xmit_skb()

[PATCH 6.1.y] gtp: disable BH before calling udp_tunnel_xmit_skb()

[Ting-Han Hou]

From: David Carlier <devnexen@gmail.com>

[ Upstream commit 5638504a2aa9e1b9d72af9060df1a160cce2d379 ]

gtp_genl_send_echo_req() runs as a generic netlink doit handler in
process context with BH not disabled. It calls udp_tunnel_xmit_skb(),
which eventually invokes iptunnel_xmit() — that uses __this_cpu_inc/dec
on softnet_data.xmit.recursion to track the tunnel xmit recursion level.

Without local_bh_disable(), the task may migrate between
dev_xmit_recursion_inc() and dev_xmit_recursion_dec(), breaking the
per-CPU counter pairing. The result is stale or negative recursion
levels that can later produce false-positive
SKB_DROP_REASON_RECURSION_LIMIT drops on either CPU.

The other udp_tunnel_xmit_skb() call sites in gtp.c are unaffected:
the data path runs under ndo_start_xmit and the echo response handlers
run from the UDP encap rx softirq, both with BH already disabled.

Fix it by disabling BH around the udp_tunnel_xmit_skb() call, mirroring
commit 2cd7e6971fc2 ("sctp: disable BH before calling
udp_tunnel_xmit_skb()").

Fixes: 6f1a9140ecda ("net: add xmit recursion limit to tunnel xmit functions")
Cc: stable@vger.kernel.org
Signed-off-by: David Carlier <devnexen@gmail.com>
Link: https://patch.msgid.link/20260417055408.4667-1-devnexen@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
[ Ting-Han: this tree does not have commit e3411e326fa4 ("net: ipv4: Add a
  flags argument to iptunnel_xmit(), udp_tunnel_xmit_skb()") or commit
  1bec9d0c0046 ("ipv4: Convert ->flowi4_tos to dscp_t."), so the
  udp_tunnel_xmit_skb() call differs in context; the change is the same ]
Assisted-by: LLM
Signed-off-by: Ting-Han Hou <ue081723@gmail.com>
---
This fixes the 6f1a9140ecda ("net: add xmit recursion limit to tunnel
xmit functions") backport that is currently in queue-6.1, so it needs
to go on top of it.

Build-tested on v6.1.190 plus queue-6.1 (x86_64, gcc 15.2,
CONFIG_GTP=m): no new W=1 or sparse warnings in drivers/net/gtp.c.
Not runtime-tested: I could not find an existing tool that sends
GTP_CMD_ECHOREQ (libgtpnl does not use it), so the echo request path
itself was not exercised.

 drivers/net/gtp.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c
index 501dbfa917408..f192a7db81d1f 100644
--- a/drivers/net/gtp.c
+++ b/drivers/net/gtp.c
@@ -1826,6 +1826,7 @@ static int gtp_genl_send_echo_req(struct sk_buff *skb, struct genl_info *info)
 		return -ENODEV;
 	}
 
+	local_bh_disable();
 	udp_tunnel_xmit_skb(rt, sk, skb_to_send,
 			    fl4.saddr, fl4.daddr,
 			    fl4.flowi4_tos,
@@ -1835,6 +1836,7 @@ static int gtp_genl_send_echo_req(struct sk_buff *skb, struct genl_info *info)
 			    !net_eq(sock_net(sk),
 				    dev_net(gtp->dev)),
 			    false);
+	local_bh_enable();
 	return 0;
 }
 
-- 
2.53.0

Re: [PATCH 6.1.y] gtp: disable BH before calling udp_tunnel_xmit_skb()

[Sasha Levin]

> This fixes the 6f1a9140ecda ("net: add xmit recursion limit to tunnel
> xmit functions") backport that is currently in queue-6.1, so it needs
> to go on top of it.

That backport has since been dropped from the 6.1 queue, so 6.1 has no
per-CPU recursion counter in iptunnel_xmit() and there is nothing for this
patch to fix there. Not applying it. Please resend it if 6f1a9140ecda
("net: add xmit recursion limit to tunnel xmit functions") is queued for 6.1
again.

-- 
Thanks,
Sasha