[PATCH v3 net-next 00/15] udp: Retire UDP-Lite.
From: Kuniyuki Iwashima <kuniyu@google.com>
Date: 2026-03-11 05:20:24
In 2023, syzbot found a null-ptr-deref bug triggered when UDP-Lite
attempted to charge an skb after the total memory usage for UDP-Lite
_and_ UDP exceeded a system-wide threshold, net.ipv4.udp_mem[1].
Since this threshold is shared with UDP, the bug would have been
easy to trigger if any real-world applications were using UDP-Lite;
however, only syzbot ever stumbled upon it.
The bug had persisted since 2016, suggesting that UDP-Lite had
remained unused for 7 years at that point.
The bug was fixed in commit ad42a35bdfc6 ("udplite: Fix NULL pointer
dereference in __sk_mem_raise_allocated()."), and we added another
commit be28c14ac8bb ("udplite: Print deprecation notice.") to
announce the deprecation plan.
Since then, no one has complained, so it is time to officially
retire UDP-Lite.
This series first removes IPv6 and IPv4 UDP-Lite sockets, then
gradually cleans up the remaining dead/unnecessary code within
the UDP stack.
By removing a bunch of conditionals for UDP-Lite from the fast
path, udp_rr with 20,000 flows sees a 10% increase in pps
(13.3 Mpps -> 14.7 Mpps) on an AMD EPYC 7B12 (Zen 2) 64-Core
Processor platform.
[ With FDO, the baseline is much higher and the delta was ~3%,
20.1 Mpps -> 20.7 Mpps ]
Before:
$ nstat > /dev/null; sleep 1; nstat | grep Udp
Udp6InDatagrams 14013408 0.0
Udp6OutDatagrams 14013128 0.0
After:
$ nstat > /dev/null; sleep 1; nstat | grep Udp
Udp6InDatagrams 15491971 0.0
Udp6OutDatagrams 15491671 0.0
$ ./scripts/bloat-o-meter vmlinux.before vmlinux.after
add/remove: 13/75 grow/shrink: 11/75 up/down: 13777/-18401 (-4624)
Function old new delta
udp4_gro_receive 872 866 -6
udp6_gro_receive 910 903 -7
udp_rcv 32 1727 +1695
udpv6_rcv 32 1450 +1418
__udp4_lib_rcv 2045 - -2045
__udp6_lib_rcv 2084 - -2084
udp_unicast_rcv_skb 160 149 -11
udp6_unicast_rcv_skb 196 181 -15
__udp4_lib_mcast_deliver 925 846 -79
__udp6_lib_mcast_deliver 922 810 -112
__udp4_lib_lookup 973 969 -4
__udp6_lib_lookup 940 929 -11
__udp4_lib_lookup_skb 106 100 -6
__udp6_lib_lookup_skb 71 66 -5
udp4_lib_lookup_skb 132 127 -5
udp6_lib_lookup_skb 87 81 -6
udp_queue_rcv_skb 326 356 +30
udpv6_queue_rcv_skb 331 361 +30
udp_queue_rcv_one_skb 1233 914 -319
udpv6_queue_rcv_one_skb 1250 930 -320
__udp_enqueue_schedule_skb 1067 995 -72
udp_rcv_segment 520 480 -40
udp_post_segment_fix_csum 120 - -120
udp_lib_checksum_complete 200 84 -116
udp_err 27 1103 +1076
udpv6_err 36 1417 +1381
__udp4_lib_err 1112 - -1112
__udp6_lib_err 1448 - -1448
udp_recvmsg 1149 994 -155
udpv6_recvmsg 1349 1294 -55
udp_sendmsg 2730 2648 -82
udp_send_skb 909 681 -228
udpv6_sendmsg 3022 2861 -161
udp_v6_send_skb 1214 952 -262
...
Total: Before=18446744073748075501, After=18446744073748070877, chg -0.00%
Changes:
v3:
Patch 7: Correct ulen < skb->len case in __udp4_lib_rcv()
v2: https://lore.kernel.org/netdev/20260305215013.2984628-1-kuniyu@google.com/ (local)
Patch 4 : Make udp_seq_ops static
Patch 9 : Add a detailed reason in include/uapi/linux/udp.h
v1: https://lore.kernel.org/netdev/20260304193034.1870586-1-kuniyu@google.com/ (local)
Kuniyuki Iwashima (15):
udp: Make udp[46]_seq_show() static.
ipv6: Retire UDP-Lite.
ipv6: Remove UDP-Lite support for IPV6_ADDRFORM.
ipv4: Retire UDP-Lite.
udp: Remove UDP-Lite SNMP stats.
smack: Remove IPPROTO_UDPLITE support in security_sock_rcv_skb().
udp: Remove partial csum code in RX.
udp: Remove partial csum code in TX.
udp: Remove UDPLITE_SEND_CSCOV and UDPLITE_RECV_CSCOV.
udp: Remove struct proto.h.udp_table.
udp: Remove udp_table in struct udp_seq_afinfo.
udp: Remove dead check in __udp[46]_lib_lookup() for BPF.
udp: Don't pass udptable to IPv6 socket lookup functions.
udp: Don't pass udptable to IPv4 socket lookup functions.
udp: Don't pass proto to __udp4_lib_rcv() and __udp6_lib_rcv().
include/linux/udp.h | 10 +-
include/net/ipv6.h | 2 -
include/net/ipv6_stubs.h | 7 +-
include/net/netns/mib.h | 5 -
include/net/sock.h | 5 +-
include/net/transp_v6.h | 3 -
include/net/udp.h | 86 +++-----
include/net/udplite.h | 88 --------
include/uapi/linux/udp.h | 2 +
net/core/filter.c | 5 +-
net/ipv4/Makefile | 2 +-
net/ipv4/af_inet.c | 12 --
net/ipv4/proc.c | 16 --
net/ipv4/udp.c | 430 ++++++++++++-------------------------
net/ipv4/udp_bpf.c | 2 -
net/ipv4/udp_diag.c | 128 +++--------
net/ipv4/udp_impl.h | 27 ---
net/ipv4/udp_offload.c | 3 +-
net/ipv4/udplite.c | 135 ------------
net/ipv6/Makefile | 2 +-
net/ipv6/af_inet6.c | 32 +--
net/ipv6/ip6_checksum.c | 2 +-
net/ipv6/ipv6_sockglue.c | 17 +-
net/ipv6/proc.c | 16 --
net/ipv6/udp.c | 304 ++++++++++----------------
net/ipv6/udp_impl.h | 31 ---
net/ipv6/udp_offload.c | 3 +-
net/ipv6/udplite.c | 139 ------------
net/rxrpc/output.c | 2 -
security/smack/smack_lsm.c | 4 +-
30 files changed, 342 insertions(+), 1178 deletions(-)
delete mode 100644 include/net/udplite.h
delete mode 100644 net/ipv4/udp_impl.h
delete mode 100644 net/ipv4/udplite.c
delete mode 100644 net/ipv6/udp_impl.h
delete mode 100644 net/ipv6/udplite.c
--
2.53.0.473.g4a7958ca14-goog