Re: [PATCH net v3] gtp: serialize PDP context updates

PDP contexts can be deleted through GTP_CMD_DELPDP or while the GTP
network device is being unregistered. The latter is serialized by RTNL,
but the generic-netlink delete path only holds RCU.

Running both paths concurrently can therefore make both paths delete the
same PDP context. The issue was found through static analysis and
reproduced on a KASAN-enabled kernel by a two-thread program
racing GTP_CMD_DELPDP against RTM_DELLINK:

  Oops: general protection fault, probably for non-canonical address
  KASAN: maybe wild-memory-access in range
         [0xdead000000000120-0xdead000000000127]
  RIP: gtp_genl_del_pdp+0x1c1/0x420 [gtp]
  RBP: dead000000000122

The second deletion dereferenced the poisoned hlist pprev pointer.

Serialize PDP context updates with a mutex shared by gtp_pdp_add(),
gtp_genl_del_pdp(), and gtp_dellink().

Fixes: 459aa660eb1d ("gtp: add initial driver for datapath of GPRS Tunneling Protocol (GTP-U)")
Assisted-by: Codex:gpt-5
Signed-off-by: Qing Ming <redacted>
---
v3:
- Rebase onto net/main.

v2: https://lore.kernel.org/netdev/20260808124322.5800-1-a0yami@mailbox.org/ (local)
- Use a dedicated mutex instead of RTNL.
- Protect PDP add, delete, and link teardown with the same mutex.

 drivers/net/gtp.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c
index 9a12cc53da00..8ee516debeed 100644
--- a/drivers/net/gtp.c
+++ b/drivers/net/gtp.c

@@ -2134,6 +2140,8 @@ static int gtp_genl_del_pdp(struct sk_buff *skb, struct genl_info *info)
 	if (!info->attrs[GTPA_VERSION])
 		return -EINVAL;
 
+	mutex_lock(&gtp_pdp_lock);
+
 	rcu_read_lock();

 	pctx = gtp_find_pdp(sock_net(skb->sk), info->attrs);

@@ -2154,6 +2162,7 @@ static int gtp_genl_del_pdp(struct sk_buff *skb, struct genl_info *info)
 
 out_unlock:
 	rcu_read_unlock();