Re: [PATCH net v4 0/5] amt: relay tunnel lifetime, validation and request-path hardening

[Omar Ramadan <omar@blockcast.net>]

Thanks for the review. The findings are addressed in v5.

The group/source worker lifetime finding is valid. Taking rcu_read_lock()
inside a delayed-work callback was too late: the callback could be dequeued,
preempted, and its owner freed before it entered RCU. v5 gives source and
group nodes separate deferred-GC links, clears their owner pointers while
teardown holds tunnel->lock, and synchronously cancels each timer in the GC
worker before kfree_rcu(). The GC worker runs outside tunnel->lock, so it can
wait for a callback that is already running. Tunnel teardown drains the group
GC before freeing the tunnel. This also prevents a source callback from
running through a freed group or tunnel.

The tunnel->dead checks are now part of patch 1. amt_update_handler() checks
tunnel->dead under tunnel->lock before either report handler, and both tunnel
freers set it while holding the same lock. The deferred Query source check is
intentional and is now described by patch 2: a queued Query is revalidated
against the current remote_ip after relay changes or reset.

Request-only tunnels retain the original GMI timeout in the intermediate
lifetime fix. They do not stamp last_seen; only an authenticated Membership
Update refreshes it and receives the 3*GMI lifetime.

Patch 5's message now describes only stateless Requests, keyed Query MAC
authentication, endpoint admission, key generations, and the liveness guard.
The unauthenticated Request endpoint scan no longer holds amt->lock, and a
failed verified tunnel allocation is dropped silently rather than reflected
with ICMP. The dead comment again documents both locks.

pw-bot: cr