[PATCH net v2] pfcp: fix socket lifetime on netdevice registration failure

[PATCH net v2] pfcp: fix socket lifetime on netdevice registration failure

[Xuanqiang Luo]

From: Xuanqiang Luo <luoxuanqiang@kylinos.cn>

pfcp_newlink() creates the UDP socket before register_netdevice().
If registration fails after pfcp_dev_init() succeeds, the core calls
pfcp_dev_uninit(), which releases the socket and clears pfcp->sk.
The newlink error path then releases it again, causing a NULL pointer
dereference. This was observed with failslab fault injection:

  FAULT_INJECTION: forcing a failure.
  kobject: kobject_add_internal failed for pfcp0 (error: -12 parent: net)
  BUG: KASAN: null-ptr-deref in udp_tunnel_sock_release+0x1c/0x50
  Read of size 8 at addr 0000000000000120 by task ip/1037
  Call trace:
   show_stack+0x18/0x24 (C)
   dump_stack_lvl+0x78/0x90
   print_report+0x468/0x5cc
   kasan_report+0xa4/0xf0
   __asan_load8+0x7c/0xd0
   udp_tunnel_sock_release+0x1c/0x50
   pfcp_newlink+0x128/0x184
   rtnl_newlink+0x848/0xe44
   rtnetlink_rcv_msg+0x468/0x514
   netlink_rcv_skb+0xc0/0x1f0
   rtnetlink_rcv+0x18/0x24
   netlink_unicast+0x4b8/0x558
   netlink_sendmsg+0x2b8/0x584
   ...

Return from pfcp_del_sock() if pfcp->sk is NULL.

Fixes: 76c8764ef36a5 ("pfcp: add PFCP module")
Cc: stable@vger.kernel.org
Signed-off-by: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
---
Changes:
v2:
  - Use a NULL check in pfcp_del_sock() as the minimal fix for net and
    stable. (Simon Horman.)

v1: https://lore.kernel.org/all/20260918123158.5631-1-xuanqiang.luo@linux.dev/

 drivers/net/pfcp.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/pfcp.c b/drivers/net/pfcp.c
index e1cca779d2ecc..3ecd43cafdf03 100644
--- a/drivers/net/pfcp.c
+++ b/drivers/net/pfcp.c
@@ -105,6 +105,9 @@ static int pfcp_encap_recv(struct sock *sk, struct sk_buff *skb)
 
 static void pfcp_del_sock(struct pfcp_dev *pfcp)
 {
+	if (!pfcp->sk)
+		return;
+
 	udp_tunnel_sock_release(pfcp->sk);
 	pfcp->sk = NULL;
 }

base-commit: 90c2e97ff8245092039ab7ab7492b34427412c9b
-- 
2.43.0

Re: [PATCH net v2] pfcp: fix socket lifetime on netdevice registration failure

[Simon Horman]

On Thu, Sep 24, 2026 at 01:52:52PM +0800, Xuanqiang Luo wrote:
> From: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
> 
> pfcp_newlink() creates the UDP socket before register_netdevice().
> If registration fails after pfcp_dev_init() succeeds, the core calls
> pfcp_dev_uninit(), which releases the socket and clears pfcp->sk.
> The newlink error path then releases it again, causing a NULL pointer
> dereference. This was observed with failslab fault injection:
> 
>   FAULT_INJECTION: forcing a failure.
>   kobject: kobject_add_internal failed for pfcp0 (error: -12 parent: net)
>   BUG: KASAN: null-ptr-deref in udp_tunnel_sock_release+0x1c/0x50
>   Read of size 8 at addr 0000000000000120 by task ip/1037
>   Call trace:
>    show_stack+0x18/0x24 (C)
>    dump_stack_lvl+0x78/0x90
>    print_report+0x468/0x5cc
>    kasan_report+0xa4/0xf0
>    __asan_load8+0x7c/0xd0
>    udp_tunnel_sock_release+0x1c/0x50
>    pfcp_newlink+0x128/0x184
>    rtnl_newlink+0x848/0xe44
>    rtnetlink_rcv_msg+0x468/0x514
>    netlink_rcv_skb+0xc0/0x1f0
>    rtnetlink_rcv+0x18/0x24
>    netlink_unicast+0x4b8/0x558
>    netlink_sendmsg+0x2b8/0x584
>    ...
> 
> Return from pfcp_del_sock() if pfcp->sk is NULL.
> 
> Fixes: 76c8764ef36a5 ("pfcp: add PFCP module")
> Cc: stable@vger.kernel.org
> Signed-off-by: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
> ---
> Changes:
> v2:
>   - Use a NULL check in pfcp_del_sock() as the minimal fix for net and
>     stable. (Simon Horman.)
> 
> v1: https://lore.kernel.org/all/20260918123158.5631-1-xuanqiang.luo@linux.dev/

Thanks for the update, and the link to v1.

Reviewed-by: Simon Horman <horms@kernel.org>