Re: [PATCH net] gtp: free the skb after handling an echo response

[Joas Antonio]

> I suggest to reconsider the error detection a bit more.
> https://elixir.bootlin.com/linux/v7.3.1/source/drivers/net/gtp.c#L541-L573
> https://cwe.mitre.org/data/definitions/252.html

Hi Markus,

thanks for looking at the patch.

Dropping the return value of genlmsg_multicast_netns() is intentional
here.  At that point the echo response has been parsed and the
notification has been handed to netlink, which owns and frees msg on
every path.  The only thing left for the handler to do is to release
the received skb, and that is the same whether the notification
reached a listener or not.

The failures that can come back are -ESRCH (nobody is subscribed to
the group) and -ENOBUFS (a listener's receive queue is full).  Neither
is a receive error for the GTP packet, and there is no recovery to
attempt.  Passing them on is what the current code does, and it is the
second problem described in the commit message: gtp_encap_recv() only
knows 1, 0 and -1, so any other negative value goes back to the UDP
stack, which treats it as a request to resubmit the packet to another
protocol.

The errors that the handler can act on, nlmsg_new() and
gtp_genl_fill_echo() failing, are still detected and now return -1 so
that the skb is dropped.

Regards,
Joas

Em ter., 10 de nov. de 2026 às 10:08, Markus Elfring
<Markus.Elfring@xxxxxx> escreveu:
>
> …
> > +++ b/drivers/net/gtp.c
> > @@ -561,16 +561,19 @@ static int gtp0_handle_echo_resp(struct gtp_dev *gtp, struct sk_buff *skb)
> …
> > -     return genlmsg_multicast_netns(&gtp_genl_family, dev_net(gtp->dev),
> > -                                    msg, 0, GTP_GENL_MCGRP, GFP_ATOMIC);
> > +     genlmsg_multicast_netns(&gtp_genl_family, dev_net(gtp->dev),
> > +                             msg, 0, GTP_GENL_MCGRP, GFP_ATOMIC);
> > +     consume_skb(skb);
> > +
> > +     return 0;
> >  }
> …
>
> I suggest to reconsider the error detection a bit more.
> https://elixir.bootlin.com/linux/v7.3.1/source/drivers/net/gtp.c#L541-L573
> https://cwe.mitre.org/data/definitions/252.html
>
> Regards,
> Markus



-- 
Joas Antonio dos Santos
Cyber Security Specialist and Ethical Hacker
joasantonio108@xxxxxxxxx
LinkedIn