kernel/linux.git/drivers/net/bareudp.c, branch v7.2-rc2

bareudp: Use rtnl_dereference() in bareudp_sock_release().

2026-05-21T02:12:29+00:00

kernel test robot reported sparse warning in bareudp_sock_release(): drivers/net/bareudp.c:288:12: warning: incorrect type in assignment (different address spaces) drivers/net/bareudp.c:288:12: expected struct sock *sk drivers/net/bareudp.c:288:12: got struct sock [noderef] __rcu *sk The warning is not new and exists since the initial bareudp commit 571912c69f0e ("net: UDP tunnel encapsulation module for tunnelling different protocols like MPLS, IP, NSH etc."). Let's use rtnl_dereference(). Note that bareudp_sock_release() is called from bareudp_stop() under RTNL, so there is no real issue even without the helper. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202605062359.e3gOfZCr-lkp@intel.com/ Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260518050726.318824-6-kuniyu@google.com Signed-off-by: Jakub Kicinski

bareudp: Remove synchronize_net() in bareudp_sock_release().

2026-05-21T02:12:29+00:00

synchronize_net() in bareudp_sock_release() has existed since day 1, commit 571912c69f0e ("net: UDP tunnel encapsulation module for tunnelling different protocols like MPLS, IP, NSH etc."). It was most likely copied from a similar tunneling device like vxlan or geneve. bareudp_sock_release() is called from dev->netdev_ops->ndo_stop(), and synchronize_net() in unregister_netdevice_many_notify() ensures that inflight bareudp fast paths finish before bareudp_dev is freed. Let's remove the redundant synchronize_net() in bareudp_sock_release(). Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260518050726.318824-5-kuniyu@google.com Signed-off-by: Jakub Kicinski

bareudp: Store struct sock in struct bareudp_dev.

2026-05-06T00:47:05+00:00

bareudp does not need to access struct socket itself in the fast path; it only reads struct sock, and struct socket is only used for tunnel setup and teardown. Let's store struct sock directly in struct bareudp_dev. bareudp_sock_release() is called from dev->netdev_ops->ndo_stop(). synchronize_net() in unregister_netdevice_many_notify() ensures that inflight bareudp RX fast paths finish before bareudp_dev is freed. bareudp no longer needs synchronize_rcu() in udp_tunnel_sock_release(). Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260502031401.3557229-11-kuniyu@google.com Signed-off-by: Jakub Kicinski

udp_tunnel: Pass struct sock to udp_tunnel6_dst_lookup().

2026-05-06T00:47:04+00:00

None of the udp_tunnel users need struct socket in their fast paths; it is only used for tunnel setup / teardown. Even udp_tunnel6_dst_lookup() does not need struct socket. Let's change udp_tunnel6_dst_lookup() to take struct sock instead of struct socket. Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260502031401.3557229-4-kuniyu@google.com Signed-off-by: Jakub Kicinski

udp_tunnel: Pass struct sock to setup_udp_tunnel_sock().

2026-05-06T00:47:04+00:00

None of the udp_tunnel users need struct socket in their fast paths; it is only used for tunnel setup / teardown. Even setup_udp_tunnel_sock() does not need struct socket. Let's change setup_udp_tunnel_sock() to take struct sock instead of struct socket. Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260502031401.3557229-3-kuniyu@google.com Signed-off-by: Jakub Kicinski

udp_tunnel: Pass struct sock to udp_tunnel_sock_release().

2026-05-06T00:47:03+00:00

None of the udp_tunnel users need struct socket in their fast paths; it is only used for tunnel setup / teardown. While the UDP tunnel interface accepts struct socket, this encourages users to store the pointer unnecessarily. This leads to extra dereferences when accessing struct sock fields (e.g., sk->sk_user_data instead of sock->sk->sk_user_data). Furthermore, these dereferences necessitate synchronize_rcu() in udp_tunnel_sock_release() to protect the fast paths from sock_orphan() setting sk->sk_socket to NULL. This overhead can be avoided if users store the struct sock pointer directly in their private structures. As a prep, let's change udp_tunnel_sock_release() to take struct sock instead of struct socket. Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260502031401.3557229-2-kuniyu@google.com Signed-off-by: Jakub Kicinski

bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst()

2026-04-29T01:16:53+00:00

bareudp_fill_metadata_dst() passes bareudp->sock to udp_tunnel6_dst_lookup() in the IPv6 path without a NULL check. The socket is only created in bareudp_open() and NULLed in bareudp_stop(), so calling this function while the device is down triggers a NULL dereference via sock->sk. BUG: kernel NULL pointer dereference, address: 0000000000000018 RIP: 0010:udp_tunnel6_dst_lookup (net/ipv6/ip6_udp_tunnel.c:160) Call Trace: bareudp_fill_metadata_dst (drivers/net/bareudp.c:532) do_execute_actions (net/openvswitch/actions.c:901) ovs_execute_actions (net/openvswitch/actions.c:1589) ovs_packet_cmd_execute (net/openvswitch/datapath.c:700) genl_family_rcv_msg_doit (net/netlink/genetlink.c:1114) genl_rcv_msg (net/netlink/genetlink.c:1209) netlink_rcv_skb (net/netlink/af_netlink.c:2550) Add a NULL check returning -ESHUTDOWN, consistent with the xmit paths in the same driver. Fixes: 571912c69f0e ("net: UDP tunnel encapsulation module for tunnelling different protocols like MPLS, IP, NSH etc.") Reported-by: Xiang Mei Signed-off-by: Weiming Shi Reviewed-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260426165350.1663137-2-bestswngs@gmail.com Signed-off-by: Jakub Kicinski

net: ipv6: Add a flags argument to ip6tunnel_xmit(), udp_tunnel6_xmit_skb()

2025-06-18T01:18:45+00:00

ip6tunnel_xmit() erases the contents of the SKB control block. In order to be able to set particular IP6CB flags on the SKB, add a corresponding parameter, and propagate it to udp_tunnel6_xmit_skb() as well. In one of the following patches, VXLAN driver will use this facility to mark packets as subject to IPv6 multicast routing. Signed-off-by: Petr Machata Reviewed-by: Ido Schimmel Reviewed-by: Nikolay Aleksandrov Link: https://patch.msgid.link/acb4f9f3e40c3a931236c3af08a720b017fbfbfb.1750113335.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski

net: ipv4: Add a flags argument to iptunnel_xmit(), udp_tunnel_xmit_skb()

2025-06-18T01:18:44+00:00

iptunnel_xmit() erases the contents of the SKB control block. In order to be able to set particular IPCB flags on the SKB, add a corresponding parameter, and propagate it to udp_tunnel_xmit_skb() as well. In one of the following patches, VXLAN driver will use this facility to mark packets as subject to IP multicast routing. Signed-off-by: Petr Machata Reviewed-by: Ido Schimmel Reviewed-by: Nikolay Aleksandrov Acked-by: Antonio Quartulli Link: https://patch.msgid.link/89c9daf9f2dc088b6b92ccebcc929f51742de91f.1750113335.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski

bareudp: Convert bareudp_exit_batch_rtnl() to ->exit_rtnl().

2025-04-15T00:08:44+00:00

bareudp_exit_batch_rtnl() iterates the dying netns list and performs the same operation for each. Let's use ->exit_rtnl(). While at it, we replace unregister_netdevice_queue() with bareudp_dellink() for better cleanup. It unlinks the device from net_generic(net, bareudp_net_id)->bareudp_list, but there is no real issue as both the dev and the list are freed later. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Sabrina Dubroca Link: https://patch.msgid.link/20250411205258.63164-13-kuniyu@amazon.com Signed-off-by: Jakub Kicinski