Re: [PATCH net] gtp: serialize PDP deletion with link teardown

[Pablo Neira Ayuso]

Hi,

On Thu, Aug 06, 2026 at 10:32:26AM +0800, Qing Ming wrote:
> PDP contexts can be deleted through GTP_CMD_DELPDP or while the GTP
> network device is being unregistered. The latter is serialized by RTNL,
> but the generic-netlink delete path only holds RCU.
> 
> Running both paths concurrently can therefore make both paths delete the
> same PDP context. On a KASAN-enabled kernel, a reproducer racing DELPDP
> against RTM_DELLINK triggered:
> 
>   Oops: general protection fault, probably for non-canonical address
>   KASAN: maybe wild-memory-access in range 
>          [0xdead000000000120-0xdead000000000127]
>   RIP: gtp_genl_del_pdp+0x1c1/0x420 [gtp]
>   RBP: dead000000000122
> 
> The second deletion dereferenced the poisoned hlist pprev pointer.
> 
> Take RTNL around the DELPDP lookup and deletion so that PDP creation,
> generic-netlink deletion and link teardown use the same serialization
> domain.

Could please you instead add a mutex to a use it to protect PDP ctx
updates? genetlink mutex is not enough, and I'd prefer not to fix this
with the rtnl lock.

Please, use this new mutex from gtp_dellink() path to protect the
iteration over the hashtable.

gtp_genl_del_pdp() must use it too as well as gtp_pdp_add().

Thanks.