[PATCH net v4 0/5] amt: relay tunnel lifetime, validation and request-path hardening

[Omar Ramadan]

Five fixes to the AMT relay data and control paths, found while adding an
IPv6 outer transport (that feature follows for net-next, rebased on this).
All are independent of the IPv6 work and belong in net with stable in mind.

1/5 closes the gc_wq re-arm use-after-free and makes device-stop teardown
safe for lockless RCU readers. 2/5 rejects gateway Query/Data from 0.0.0.0
before a relay is learned. 3/5 requires exactly four bytes for the IPv4
input attributes, avoiding silent truncation of larger payloads. 4/5 makes
pre-Query report drops visible and stops counting forwarded reports as
drops. 5/5 keys relay tunnels on the (address, port) endpoint, authenticates
Updates before allocating tunnel state, and closes the report-group and
post-stop creation races found in review of v3.

Each patch carries a Fixes: tag. The exact tip builds warning-free with
GCC and Clang, W=1, with IPv6 enabled and disabled. A KASAN + lockdep +
PROVE_RCU kernel passes amt.sh 6/6 with no splats. The full-table control
(max_tunnels=1) gives the same result as v3.

v4:
- 1/5: unlink tunnels in place with list_del_rcu() and defer their free
  with kfree_rcu(); do not splice onto a stack head visible to RCU readers.
- 3/5: replace the IPv6-length special case with NLA_POLICY_EXACT_LEN for
  LOCAL_IP and DISCOVERY_IP. REMOTE_IP is output-only and is unchanged.
- 4/5: return directly after a successful Membership Update, use
  DEV_STATS_INC() for tx counters, and clarify the debug message.
- 5/5: fold v3's endpoint-keying patch into the authenticated-allocation
  patch, so no intermediate commit allocates unauthenticated port-keyed
  tunnels; retain four secret generations (180s floor > 125s QQIC);
  withhold Queries at both tunnel limits and silently drop refused
  Requests; re-check dead under the tunnel lock before report handling;
  reject creation after device stop.
- Rewrap the comments reported by NIPA at 80 columns.

v3: https://lore.kernel.org/netdev/20261012125943.558629-1-omar@xxxxxxxxxxxxx/
v2: https://lore.kernel.org/netdev/20261009201455.1904698-1-omar@xxxxxxxxxxxxx/
v1: https://lore.kernel.org/netdev/20261008003606.3666617-1-omar@xxxxxxxxxxxxx/

Omar Ramadan (5):
  amt: fix use-after-free when a Membership Update re-arms a freed
    tunnel
  amt: reject a gateway Query or Data from 0.0.0.0 before a relay is
    learned
  amt: require an exact IPv4-sized IFLA_AMT_{LOCAL,DISCOVERY}_IP
  amt: make pre-query report drops visible
  amt: harden relay tunnel lifetime and request admission

 drivers/net/amt.c | 389 +++++++++++++++++++++++++++++++++++-----------
 include/net/amt.h |  27 +++-
 2 files changed, 317 insertions(+), 99 deletions(-)