diff options
| author | Cen Zhang (Microsoft) <blbllhy@gmail.com> | 2026-08-19 22:07:35 -0400 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2026-08-24 11:30:39 -0700 |
| commit | d989e22ae9802c52c56ad4284d0caf26696cf6ae (patch) | |
| tree | 3081811c04b0f01eccec594df7768d1b5d649228 /tools/perf/scripts/python/netdev-times.py | |
| parent | 3e995a30b9e3812e61e50669d4ea4642d3362ef6 (diff) | |
gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free
gtp_newlink()'s error path frees tid_hash and addr_hash without
waiting for an RCU grace period after clearing sk_user_data. A
concurrent gtp_encap_recv() in softirq may still hold the gtp_dev
pointer obtained via rcu_dereference_sk_user_data() and access the
freed memory.
BUG: KASAN: slab-use-after-free in gtp0_pdp_find+0x1f6/0x200 (gtp.c:152)
Call Trace:
<IRQ>
gtp0_pdp_find+0x1f6/0x200
gtp_encap_recv+0x527/0x24b0
udp_queue_rcv_one_skb+0x75f/0xc10
Add synchronize_net() before the kfree calls in out_hashtable, which
covers all error paths from both gtp_encap_enable() and
gtp_create_sockets().
Fixes: 459aa660eb1d8ce6 ("gtp: add initial driver for datapath of GPRS Tunneling Protocol (GTP-U)")
Reported-by: AutonomousCodeSecurity@microsoft.com
Reported-by: Xiang Mei (Microsoft) <xmei5@asu.edu>
Reported-by: Cen Zhang (Microsoft) <blbllhy@gmail.com>
Signed-off-by: Cen Zhang (Microsoft) <blbllhy@gmail.com>
Link: https://patch.msgid.link/20260820020735.59474-1-blbllhy@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'tools/perf/scripts/python/netdev-times.py')
0 files changed, 0 insertions, 0 deletions