Re: [PATCH net v2 0/2] gtp: fix sk_created race conditions

[Pablo Neira Ayuso]

On Tue, Aug 25, 2026 at 01:24:02AM -0400, Cen Zhang (Microsoft) wrote:
> Two races exist around the sk_created flag in the GTP driver: an
> initialization ordering issue where sk_created is published before the
> socket pointers are assigned, and a teardown lifetime issue where
> concurrent readers can still use the sockets after they are freed. They
> are split into separate patches because they require fundamentally
> different fixes -- memory barriers for ordering vs synchronize_net() and
> RTNL for lifetime.

May I suggest to partial revert of these patches?

 d33bd757d362 ("gtp: Implement GTP echo request")
 9af41cc33471 ("gtp: Implement GTP echo response")

I don't see a use-case for them

I can see a use-case for:

b20dc3c68458 ("gtp: Allow to create GTP device without FDs")

for testing purpose, ie. allowing to create a GTP tunnel without a
userspace program which deals with control plane.

As far as I understood, the reported issues are all related to them.

> Changes since v1 [1]:
> - Use smp_store_release()/smp_load_acquire() for proper memory ordering
>   as suggested by Simon Horman.
> - Add patch 2/2 to fix teardown races in gtp_encap_disable(): reorder
>   to clear sk_created first, add synchronize_net() for softirq paths,
>   and hold RTNL in gtp_genl_send_echo_req() for the process-context
>   path that synchronize_net() cannot protect.
> 
> Patch 1/2 fixes the initialization ordering race.
> Patch 2/2 fixes the teardown lifetime races (softirq + genl).
> 
> [1] https://lore.kernel.org/netdev/20260816035205.57966-1-blbllhy@xxxxxxxxx/
> 
> Cen Zhang (Microsoft) (2):
>   gtp: fix sk_created publication race in gtp_create_sockets()
>   gtp: fix use-after-free during GTP device teardown
> 
>  drivers/net/gtp.c | 70 ++++++++++++++++++++++++++++++++++-------------
>  1 file changed, 51 insertions(+), 19 deletions(-)
> 
> 
> base-commit: b70b7b71561f2be1183b6046964d950c2b203bfc
> -- 
> 2.55.0