cve/published/2025/CVE-2025-21865.mbox - pub/scm/linux/security/vulns - Git at Google

 From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001
 From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 To: <linux-cve-announce@vger.kernel.org>
 Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
 Subject: CVE-2025-21865: gtp: Suppress list corruption splat in gtp_net_exit_batch_rtnl().

 Description
 ===========

 In the Linux kernel, the following vulnerability has been resolved:

 gtp: Suppress list corruption splat in gtp_net_exit_batch_rtnl().

 Brad Spengler reported the list_del() corruption splat in
 gtp_net_exit_batch_rtnl(). [0]

 Commit eb28fd76c0a0 ("gtp: Destroy device along with udp socket's netns
 dismantle.") added the for_each_netdev() loop in gtp_net_exit_batch_rtnl()
 to destroy devices in each netns as done in geneve and ip tunnels.

 However, this could trigger ->dellink() twice for the same device during
 ->exit_batch_rtnl().

 Say we have two netns A & B and gtp device B that resides in netns B but
 whose UDP socket is in netns A.

   1. cleanup_net() processes netns A and then B.

   2. gtp_net_exit_batch_rtnl() finds the device B while iterating
      netns A's gn->gtp_dev_list and calls ->dellink().

   [ device B is not yet unlinked from netns B
     as unregister_netdevice_many() has not been called. ]

   3. gtp_net_exit_batch_rtnl() finds the device B while iterating
      netns B's for_each_netdev() and calls ->dellink().

 gtp_dellink() cleans up the device's hash table, unlinks the dev from
 gn->gtp_dev_list, and calls unregister_netdevice_queue().

 Basically, calling gtp_dellink() multiple times is fine unless
 CONFIG_DEBUG_LIST is enabled.

 Let's remove for_each_netdev() in gtp_net_exit_batch_rtnl() and
 delegate the destruction to default_device_exit_batch() as done
 in bareudp.

 [0]:
 list_del corruption, ffff8880aaa62c00->next (autoslab_size_M_dev_P_net_core_dev_11127_8_1328_8_S_4096_A_64_n_139+0xc00/0x1000 [slab object]) is LIST_POISON1 (ffffffffffffff02) (prev is 0xffffffffffffff04)
 kernel BUG at lib/list_debug.c:58!
 Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN
 CPU: 1 UID: 0 PID: 1804 Comm: kworker/u8:7 Tainted: G                T   6.12.13-grsec-full-20250211091339 #1
 Tainted: [T]=RANDSTRUCT
 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
 Workqueue: netns cleanup_net
 RIP: 0010:[<ffffffff84947381>] __list_del_entry_valid_or_report+0x141/0x200 lib/list_debug.c:58
 Code: c2 76 91 31 c0 e8 9f b1 f7 fc 0f 0b 4d 89 f0 48 c7 c1 02 ff ff ff 48 89 ea 48 89 ee 48 c7 c7 e0 c2 76 91 31 c0 e8 7f b1 f7 fc <0f> 0b 4d 89 e8 48 c7 c1 04 ff ff ff 48 89 ea 48 89 ee 48 c7 c7 60
 RSP: 0018:fffffe8040b4fbd0 EFLAGS: 00010283
 RAX: 00000000000000cc RBX: dffffc0000000000 RCX: ffffffff818c4054
 RDX: ffffffff84947381 RSI: ffffffff818d1512 RDI: 0000000000000000
 RBP: ffff8880aaa62c00 R08: 0000000000000001 R09: fffffbd008169f32
 R10: fffffe8040b4f997 R11: 0000000000000001 R12: a1988d84f24943e4
 R13: ffffffffffffff02 R14: ffffffffffffff04 R15: ffff8880aaa62c08
 RBX: kasan shadow of 0x0
 RCX: __wake_up_klogd.part.0+0x74/0xe0 kernel/printk/printk.c:4554
 RDX: __list_del_entry_valid_or_report+0x141/0x200 lib/list_debug.c:58
 RSI: vprintk+0x72/0x100 kernel/printk/printk_safe.c:71
 RBP: autoslab_size_M_dev_P_net_core_dev_11127_8_1328_8_S_4096_A_64_n_139+0xc00/0x1000 [slab object]
 RSP: process kstack fffffe8040b4fbd0+0x7bd0/0x8000 [kworker/u8:7+netns 1804 ]
 R09: kasan shadow of process kstack fffffe8040b4f990+0x7990/0x8000 [kworker/u8:7+netns 1804 ]
 R10: process kstack fffffe8040b4f997+0x7997/0x8000 [kworker/u8:7+netns 1804 ]
 R15: autoslab_size_M_dev_P_net_core_dev_11127_8_1328_8_S_4096_A_64_n_139+0xc08/0x1000 [slab object]
 FS:  0000000000000000(0000) GS:ffff888116000000(0000) knlGS:0000000000000000
 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 CR2: 0000748f5372c000 CR3: 0000000015408000 CR4: 00000000003406f0 shadow CR4: 00000000003406f0
 Stack:
  0000000000000000 ffffffff8a0c35e7 ffffffff8a0c3603 ffff8880aaa62c00
  ffff8880aaa62c00 0000000000000004 ffff88811145311c 0000000000000005
  0000000000000001 ffff8880aaa62000 fffffe8040b4fd40 ffffffff8a0c360d
 Call Trace:
  <TASK>
  [<ffffffff8a0c360d>] __list_del_entry_valid include/linux/list.h:131 [inline] fffffe8040b4fc28
  [<ffffffff8a0c360d>] __list_del_entry include/linux/list.h:248 [inline] fffffe8040b4fc28
  [<ffffffff8a0c360d>] list_del include/linux/list.h:262 [inline] fffffe8040b4fc28
  [<ffffffff8a0c360d>] gtp_dellink+0x16d/0x360 drivers/net/gtp.c:1557 fffffe8040b4fc28
  [<ffffffff8a0d0404>] gtp_net_exit_batch_rtnl+0x124/0x2c0 drivers/net/gtp.c:2495 fffffe8040b4fc88
  [<ffffffff8e705b24>] cleanup_net+0x5a4/0xbe0 net/core/net_namespace.c:635 fffffe8040b4fcd0
  [<ffffffff81754c97>] process_one_work+0xbd7/0x2160 kernel/workqueue.c:3326 fffffe8040b4fd88
  [<ffffffff81757195>] process_scheduled_works kernel/workqueue.c:3407 [inline] fffffe8040b4fec0
  [<ffffffff81757195>] worker_thread+0x6b5/0xfa0 kernel/workqueue.c:3488 fffffe8040b4fec0
  [<ffffffff817782a0>] kthread+0x360/0x4c0 kernel/kthread.c:397 fffffe8040b4ff78
  [<ffffffff814d8594>] ret_from_fork+0x74/0xe0 arch/x86/kernel/process.c:172 fffffe8040b4ffb8
  [<ffffffff8110f509>] ret_from_fork_asm+0x29/0xc0 arch/x86/entry/entry_64.S:399 fffffe8040b4ffe8
  </TASK>
 Modules linked in:

 The Linux kernel CVE team has assigned CVE-2025-21865 to this issue.


 Affected and fixed versions
 ===========================

 	Issue introduced in 5.4.290 with commit c986380c1d5274c4d5e935addc807d6791cc23eb and fixed in 5.4.291 with commit 7f86fb07db65a470d0c11f79da551bd9466357dc
 	Issue introduced in 5.10.234 with commit 5f1678346109ff3a6d229d33437fcba3cce9209d and fixed in 5.10.235 with commit 33eb925c0c26e86ca540a08254806512bf911f22
 	Issue introduced in 5.15.177 with commit 036f8d814a2cd11ee8ef62b8f3e7ce5dec0ee4f3 and fixed in 5.15.179 with commit cb15bb1bde0ba97cbbed9508e45210dcafec3657
 	Issue introduced in 6.1.127 with commit efec287cbac92ac6ee8312a89221854760e13b34 and fixed in 6.1.130 with commit b70fa591b066d52b141fc430ffdee35b6cc87a66
 	Issue introduced in 6.6.74 with commit bb11f992f5a475bc68ef959f17a55306f0328495 and fixed in 6.6.80 with commit 9d03e7e37187ae140e716377599493987fb20c5b
 	Issue introduced in 6.12.11 with commit 86f73d4ab2f27deeff22ba9336ad103d94f12ac7 and fixed in 6.12.17 with commit ff81b14010362f6188ca26fec22ff05e4da45595
 	Issue introduced in 6.13 with commit eb28fd76c0a08a47b470677c6cef9dd1c60e92d1 and fixed in 6.13.5 with commit 37e7644b961600ef0beb01d3970c3034a62913af
 	Issue introduced in 6.13 with commit eb28fd76c0a08a47b470677c6cef9dd1c60e92d1 and fixed in 6.14 with commit 4ccacf86491d33d2486b62d4d44864d7101b299d

 Please see https://www.kernel.org for a full list of currently supported
 kernel versions by the kernel community.

 Unaffected versions might change over time as fixes are backported to
 older supported kernel versions.  The official CVE entry at
 	https://cve.org/CVERecord/?id=CVE-2025-21865
 will be updated if fixes are backported, please check that for the most
 up to date information about this issue.


 Affected files
 ==============

 The file(s) affected by this issue are:
 	drivers/net/gtp.c


 Mitigation
 ==========

 The Linux kernel CVE team recommends that you update to the latest
 stable kernel version for this, and many other bugfixes.  Individual
 changes are never tested alone, but rather are part of a larger kernel
 release.  Cherry-picking individual commits is not recommended or
 supported by the Linux kernel community at all.  If however, updating to
 the latest release is impossible, the individual changes to resolve this
 issue can be found at these commits:
 	https://git.kernel.org/stable/c/7f86fb07db65a470d0c11f79da551bd9466357dc
 	https://git.kernel.org/stable/c/33eb925c0c26e86ca540a08254806512bf911f22
 	https://git.kernel.org/stable/c/cb15bb1bde0ba97cbbed9508e45210dcafec3657
 	https://git.kernel.org/stable/c/b70fa591b066d52b141fc430ffdee35b6cc87a66
 	https://git.kernel.org/stable/c/9d03e7e37187ae140e716377599493987fb20c5b
 	https://git.kernel.org/stable/c/ff81b14010362f6188ca26fec22ff05e4da45595
 	https://git.kernel.org/stable/c/37e7644b961600ef0beb01d3970c3034a62913af
 	https://git.kernel.org/stable/c/4ccacf86491d33d2486b62d4d44864d7101b299d
	From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001
	From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
	To: <linux-cve-announce@vger.kernel.org>
	Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
	Subject: CVE-2025-21865: gtp: Suppress list corruption splat in gtp_net_exit_batch_rtnl().

	Description
	===========

	In the Linux kernel, the following vulnerability has been resolved:

	gtp: Suppress list corruption splat in gtp_net_exit_batch_rtnl().

	Brad Spengler reported the list_del() corruption splat in
	gtp_net_exit_batch_rtnl(). [0]

	Commit eb28fd76c0a0 ("gtp: Destroy device along with udp socket's netns
	dismantle.") added the for_each_netdev() loop in gtp_net_exit_batch_rtnl()
	to destroy devices in each netns as done in geneve and ip tunnels.

	However, this could trigger ->dellink() twice for the same device during
	->exit_batch_rtnl().

	Say we have two netns A & B and gtp device B that resides in netns B but
	whose UDP socket is in netns A.

	1. cleanup_net() processes netns A and then B.

	2. gtp_net_exit_batch_rtnl() finds the device B while iterating
	netns A's gn->gtp_dev_list and calls ->dellink().

	[ device B is not yet unlinked from netns B
	as unregister_netdevice_many() has not been called. ]

	3. gtp_net_exit_batch_rtnl() finds the device B while iterating
	netns B's for_each_netdev() and calls ->dellink().

	gtp_dellink() cleans up the device's hash table, unlinks the dev from
	gn->gtp_dev_list, and calls unregister_netdevice_queue().

	Basically, calling gtp_dellink() multiple times is fine unless
	CONFIG_DEBUG_LIST is enabled.

	Let's remove for_each_netdev() in gtp_net_exit_batch_rtnl() and
	delegate the destruction to default_device_exit_batch() as done
	in bareudp.

	[0]:
	list_del corruption, ffff8880aaa62c00->next (autoslab_size_M_dev_P_net_core_dev_11127_8_1328_8_S_4096_A_64_n_139+0xc00/0x1000 [slab object]) is LIST_POISON1 (ffffffffffffff02) (prev is 0xffffffffffffff04)
	kernel BUG at lib/list_debug.c:58!
	Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN
	CPU: 1 UID: 0 PID: 1804 Comm: kworker/u8:7 Tainted: G T 6.12.13-grsec-full-20250211091339 #1
	Tainted: [T]=RANDSTRUCT
	Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
	Workqueue: netns cleanup_net
	RIP: 0010:[<ffffffff84947381>] __list_del_entry_valid_or_report+0x141/0x200 lib/list_debug.c:58
	Code: c2 76 91 31 c0 e8 9f b1 f7 fc 0f 0b 4d 89 f0 48 c7 c1 02 ff ff ff 48 89 ea 48 89 ee 48 c7 c7 e0 c2 76 91 31 c0 e8 7f b1 f7 fc <0f> 0b 4d 89 e8 48 c7 c1 04 ff ff ff 48 89 ea 48 89 ee 48 c7 c7 60
	RSP: 0018:fffffe8040b4fbd0 EFLAGS: 00010283
	RAX: 00000000000000cc RBX: dffffc0000000000 RCX: ffffffff818c4054
	RDX: ffffffff84947381 RSI: ffffffff818d1512 RDI: 0000000000000000
	RBP: ffff8880aaa62c00 R08: 0000000000000001 R09: fffffbd008169f32
	R10: fffffe8040b4f997 R11: 0000000000000001 R12: a1988d84f24943e4
	R13: ffffffffffffff02 R14: ffffffffffffff04 R15: ffff8880aaa62c08
	RBX: kasan shadow of 0x0
	RCX: __wake_up_klogd.part.0+0x74/0xe0 kernel/printk/printk.c:4554
	RDX: __list_del_entry_valid_or_report+0x141/0x200 lib/list_debug.c:58
	RSI: vprintk+0x72/0x100 kernel/printk/printk_safe.c:71
	RBP: autoslab_size_M_dev_P_net_core_dev_11127_8_1328_8_S_4096_A_64_n_139+0xc00/0x1000 [slab object]
	RSP: process kstack fffffe8040b4fbd0+0x7bd0/0x8000 [kworker/u8:7+netns 1804 ]
	R09: kasan shadow of process kstack fffffe8040b4f990+0x7990/0x8000 [kworker/u8:7+netns 1804 ]
	R10: process kstack fffffe8040b4f997+0x7997/0x8000 [kworker/u8:7+netns 1804 ]
	R15: autoslab_size_M_dev_P_net_core_dev_11127_8_1328_8_S_4096_A_64_n_139+0xc08/0x1000 [slab object]
	FS: 0000000000000000(0000) GS:ffff888116000000(0000) knlGS:0000000000000000
	CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
	CR2: 0000748f5372c000 CR3: 0000000015408000 CR4: 00000000003406f0 shadow CR4: 00000000003406f0
	Stack:
	0000000000000000 ffffffff8a0c35e7 ffffffff8a0c3603 ffff8880aaa62c00
	ffff8880aaa62c00 0000000000000004 ffff88811145311c 0000000000000005
	0000000000000001 ffff8880aaa62000 fffffe8040b4fd40 ffffffff8a0c360d
	Call Trace:
	<TASK>
	[<ffffffff8a0c360d>] __list_del_entry_valid include/linux/list.h:131 [inline] fffffe8040b4fc28
	[<ffffffff8a0c360d>] __list_del_entry include/linux/list.h:248 [inline] fffffe8040b4fc28
	[<ffffffff8a0c360d>] list_del include/linux/list.h:262 [inline] fffffe8040b4fc28
	[<ffffffff8a0c360d>] gtp_dellink+0x16d/0x360 drivers/net/gtp.c:1557 fffffe8040b4fc28
	[<ffffffff8a0d0404>] gtp_net_exit_batch_rtnl+0x124/0x2c0 drivers/net/gtp.c:2495 fffffe8040b4fc88
	[<ffffffff8e705b24>] cleanup_net+0x5a4/0xbe0 net/core/net_namespace.c:635 fffffe8040b4fcd0
	[<ffffffff81754c97>] process_one_work+0xbd7/0x2160 kernel/workqueue.c:3326 fffffe8040b4fd88
	[<ffffffff81757195>] process_scheduled_works kernel/workqueue.c:3407 [inline] fffffe8040b4fec0
	[<ffffffff81757195>] worker_thread+0x6b5/0xfa0 kernel/workqueue.c:3488 fffffe8040b4fec0
	[<ffffffff817782a0>] kthread+0x360/0x4c0 kernel/kthread.c:397 fffffe8040b4ff78
	[<ffffffff814d8594>] ret_from_fork+0x74/0xe0 arch/x86/kernel/process.c:172 fffffe8040b4ffb8
	[<ffffffff8110f509>] ret_from_fork_asm+0x29/0xc0 arch/x86/entry/entry_64.S:399 fffffe8040b4ffe8
	</TASK>
	Modules linked in:

	The Linux kernel CVE team has assigned CVE-2025-21865 to this issue.


	Affected and fixed versions
	===========================

	Issue introduced in 5.4.290 with commit c986380c1d5274c4d5e935addc807d6791cc23eb and fixed in 5.4.291 with commit 7f86fb07db65a470d0c11f79da551bd9466357dc
	Issue introduced in 5.10.234 with commit 5f1678346109ff3a6d229d33437fcba3cce9209d and fixed in 5.10.235 with commit 33eb925c0c26e86ca540a08254806512bf911f22
	Issue introduced in 5.15.177 with commit 036f8d814a2cd11ee8ef62b8f3e7ce5dec0ee4f3 and fixed in 5.15.179 with commit cb15bb1bde0ba97cbbed9508e45210dcafec3657
	Issue introduced in 6.1.127 with commit efec287cbac92ac6ee8312a89221854760e13b34 and fixed in 6.1.130 with commit b70fa591b066d52b141fc430ffdee35b6cc87a66
	Issue introduced in 6.6.74 with commit bb11f992f5a475bc68ef959f17a55306f0328495 and fixed in 6.6.80 with commit 9d03e7e37187ae140e716377599493987fb20c5b
	Issue introduced in 6.12.11 with commit 86f73d4ab2f27deeff22ba9336ad103d94f12ac7 and fixed in 6.12.17 with commit ff81b14010362f6188ca26fec22ff05e4da45595
	Issue introduced in 6.13 with commit eb28fd76c0a08a47b470677c6cef9dd1c60e92d1 and fixed in 6.13.5 with commit 37e7644b961600ef0beb01d3970c3034a62913af
	Issue introduced in 6.13 with commit eb28fd76c0a08a47b470677c6cef9dd1c60e92d1 and fixed in 6.14 with commit 4ccacf86491d33d2486b62d4d44864d7101b299d

	Please see https://www.kernel.org for a full list of currently supported
	kernel versions by the kernel community.

	Unaffected versions might change over time as fixes are backported to
	older supported kernel versions. The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-21865
	will be updated if fixes are backported, please check that for the most
	up to date information about this issue.


	Affected files
	==============

	The file(s) affected by this issue are:
	drivers/net/gtp.c


	Mitigation
	==========

	The Linux kernel CVE team recommends that you update to the latest
	stable kernel version for this, and many other bugfixes. Individual
	changes are never tested alone, but rather are part of a larger kernel
	release. Cherry-picking individual commits is not recommended or
	supported by the Linux kernel community at all. If however, updating to
	the latest release is impossible, the individual changes to resolve this
	issue can be found at these commits:
	https://git.kernel.org/stable/c/7f86fb07db65a470d0c11f79da551bd9466357dc
	https://git.kernel.org/stable/c/33eb925c0c26e86ca540a08254806512bf911f22
	https://git.kernel.org/stable/c/cb15bb1bde0ba97cbbed9508e45210dcafec3657
	https://git.kernel.org/stable/c/b70fa591b066d52b141fc430ffdee35b6cc87a66
	https://git.kernel.org/stable/c/9d03e7e37187ae140e716377599493987fb20c5b
	https://git.kernel.org/stable/c/ff81b14010362f6188ca26fec22ff05e4da45595
	https://git.kernel.org/stable/c/37e7644b961600ef0beb01d3970c3034a62913af
	https://git.kernel.org/stable/c/4ccacf86491d33d2486b62d4d44864d7101b299d