[PATCH net v2 0/2] gtp: fix sk_created race conditions

[Cen Zhang (Microsoft)]

Two races exist around the sk_created flag in the GTP driver: an
initialization ordering issue where sk_created is published before the
socket pointers are assigned, and a teardown lifetime issue where
concurrent readers can still use the sockets after they are freed. They
are split into separate patches because they require fundamentally
different fixes -- memory barriers for ordering vs synchronize_net() and
RTNL for lifetime.

Changes since v1 [1]:
- Use smp_store_release()/smp_load_acquire() for proper memory ordering
  as suggested by Simon Horman.
- Add patch 2/2 to fix teardown races in gtp_encap_disable(): reorder
  to clear sk_created first, add synchronize_net() for softirq paths,
  and hold RTNL in gtp_genl_send_echo_req() for the process-context
  path that synchronize_net() cannot protect.

Patch 1/2 fixes the initialization ordering race.
Patch 2/2 fixes the teardown lifetime races (softirq + genl).

[1] https://lore.kernel.org/netdev/20260816035205.57966-1-blbllhy@xxxxxxxxx/

Cen Zhang (Microsoft) (2):
  gtp: fix sk_created publication race in gtp_create_sockets()
  gtp: fix use-after-free during GTP device teardown

 drivers/net/gtp.c | 70 ++++++++++++++++++++++++++++++++++-------------
 1 file changed, 51 insertions(+), 19 deletions(-)


base-commit: b70b7b71561f2be1183b6046964d950c2b203bfc
-- 
2.55.0