[PATCH net] udp: resubmit encap packets for secondary mcast sockets

[PATCH net] udp: resubmit encap packets for secondary mcast sockets

[Mariano Baragiola]

Multicast delivery clones packets for listeners after the first one.
Commit 3cb8d4b9bfeb ("udp: fix encapsulation packet resubmit in multicast
deliver") fixed encapsulation packet resubmission for the primary
listener by propagating positive return values from udp_queue_rcv_skb()
to the outer IP layer. However, it left the loop over secondary matching
sockets unchanged.

When an encapsulation receive handler requests protocol resubmission for
a clone (ret > 0), the secondary delivery loop currently calls
consume_skb(nskb), silently dropping the packet.

Resubmit cloned IPv4 and IPv6 packets directly to the returned protocol
via ip_protocol_deliver_rcu() and ip6_protocol_deliver_rcu(..., true),
matching the ownership and resubmission conventions used in the
segmented GSO paths.

Fixes: 3cb8d4b9bfeb ("udp: fix encapsulation packet resubmit in multicast deliver")
Signed-off-by: Mariano Baragiola <mbaragiola@linux.com>
---
 net/ipv4/udp.c | 5 +++--
 net/ipv6/udp.c | 5 +++--
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index bb8cfc62cb00..d79be57854e3 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -2522,8 +2522,9 @@ static int __udp4_lib_mcast_deliver(struct net *net, struct sk_buff *skb,
 			__UDP_INC_STATS(net, UDP_MIB_INERRORS);
 			continue;
 		}
-		if (udp_queue_rcv_skb(sk, nskb) > 0)
-			consume_skb(nskb);
+		ret = udp_queue_rcv_skb(sk, nskb);
+		if (ret > 0)
+			ip_protocol_deliver_rcu(net, nskb, ret);
 	}
 
 	/* Also lookup *:port if we are using hash2 and haven't done so yet. */
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 93478d1ad576..ca8d0a1844d2 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -1001,8 +1001,9 @@ static int __udp6_lib_mcast_deliver(struct net *net, struct sk_buff *skb,
 			continue;
 		}
 
-		if (udpv6_queue_rcv_skb(sk, nskb) > 0)
-			consume_skb(nskb);
+		ret = udpv6_queue_rcv_skb(sk, nskb);
+		if (ret > 0)
+			ip6_protocol_deliver_rcu(net, nskb, ret, true);
 	}
 
 	/* Also lookup *:port if we are using hash2 and haven't done so yet. */
-- 
2.55.0

Re: [PATCH net] udp: resubmit encap packets for secondary mcast sockets

[Kuniyuki Iwashima]

On Fri, Sep 18, 2026 at 8:36 AM Mariano Baragiola <mbaragiola@linux.com> wrote:
>
> Multicast delivery clones packets for listeners after the first one.
> Commit 3cb8d4b9bfeb ("udp: fix encapsulation packet resubmit in multicast
> deliver") fixed encapsulation packet resubmission for the primary
> listener by propagating positive return values from udp_queue_rcv_skb()
> to the outer IP layer. However, it left the loop over secondary matching
> sockets unchanged.

Did you see a real problem or is this triggered by an AI report?

https://lore.kernel.org/netdev/20260415203624.4057135-1-kuniyu@google.com/


>
> When an encapsulation receive handler requests protocol resubmission for
> a clone (ret > 0), the secondary delivery loop currently calls
> consume_skb(nskb), silently dropping the packet.
>
> Resubmit cloned IPv4 and IPv6 packets directly to the returned protocol
> via ip_protocol_deliver_rcu() and ip6_protocol_deliver_rcu(..., true),
> matching the ownership and resubmission conventions used in the
> segmented GSO paths.
>
> Fixes: 3cb8d4b9bfeb ("udp: fix encapsulation packet resubmit in multicast deliver")
> Signed-off-by: Mariano Baragiola <mbaragiola@linux.com>
> ---
>  net/ipv4/udp.c | 5 +++--
>  net/ipv6/udp.c | 5 +++--
>  2 files changed, 6 insertions(+), 4 deletions(-)
>
> diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
> index bb8cfc62cb00..d79be57854e3 100644
> --- a/net/ipv4/udp.c
> +++ b/net/ipv4/udp.c
> @@ -2522,8 +2522,9 @@ static int __udp4_lib_mcast_deliver(struct net *net, struct sk_buff *skb,
>                         __UDP_INC_STATS(net, UDP_MIB_INERRORS);
>                         continue;
>                 }
> -               if (udp_queue_rcv_skb(sk, nskb) > 0)
> -                       consume_skb(nskb);
> +               ret = udp_queue_rcv_skb(sk, nskb);
> +               if (ret > 0)
> +                       ip_protocol_deliver_rcu(net, nskb, ret);
>         }
>
>         /* Also lookup *:port if we are using hash2 and haven't done so yet. */
> diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
> index 93478d1ad576..ca8d0a1844d2 100644
> --- a/net/ipv6/udp.c
> +++ b/net/ipv6/udp.c
> @@ -1001,8 +1001,9 @@ static int __udp6_lib_mcast_deliver(struct net *net, struct sk_buff *skb,
>                         continue;
>                 }
>
> -               if (udpv6_queue_rcv_skb(sk, nskb) > 0)
> -                       consume_skb(nskb);
> +               ret = udpv6_queue_rcv_skb(sk, nskb);
> +               if (ret > 0)
> +                       ip6_protocol_deliver_rcu(net, nskb, ret, true);
>         }
>
>         /* Also lookup *:port if we are using hash2 and haven't done so yet. */
> --
> 2.55.0
>

Re: [PATCH net] udp: resubmit encap packets for secondary mcast sockets

[Mariano Baragiola]

On Fri, Sep 18, 2026 at 9:21 AM Kuniyuki Iwashima <kuniyu@google.com> wrote:
> Did you see a real problem or is this triggered by an AI report?
>
> https://lore.kernel.org/netdev/20260415203624.4057135-1-kuniyu@google.com/

Hi Kuniyuki,

To be completely transparent: this was identified during a code audit following commit 3cb8d4b9bfeb, not from a production crash report.

I recognize that standard FOU configurations do not typically have multiple listeners on the same port (returning -EADDRINUSE), so this primarily affects multi-socket/SO_REUSEPORT encapsulation scenarios. If you consider this an edge case not worth touching, I am completely fine dropping the patch.

Thanks,
Mariano

Re: [PATCH net] udp: resubmit encap packets for secondary mcast sockets

[Kuniyuki Iwashima]

On Fri, Sep 18, 2026 at 10:00 AM Mariano Baragiola <mbaragiola@linux.com> wrote:
>
> On Fri, Sep 18, 2026 at 9:21 AM Kuniyuki Iwashima <kuniyu@google.com> wrote:
> > Did you see a real problem or is this triggered by an AI report?
> >
> > https://lore.kernel.org/netdev/20260415203624.4057135-1-kuniyu@google.com/
>
> Hi Kuniyuki,
>
> To be completely transparent: this was identified during a code audit following
> commit 3cb8d4b9bfeb, not from a production crash report.
>
> I recognize that standard FOU configurations do not typically have multiple listeners
> on the same port (returning -EADDRINUSE), so this primarily affects
> multi-socket/SO_REUSEPORT encapsulation scenarios. If you consider this an
> edge case not worth touching, I am completely fine dropping the patch.

Since the patch adds ip_protocol_deliver_rcu(), syzbot will find a
way to trigger stack overflow, so I think it's not worth a fix unless
there is a real use case.