[PATCH net v4 0/5] amt: relay tunnel lifetime, validation and request-path hardening

[Omar Ramadan]

This series hardens AMT relay tunnel lifetime, validates gateway input, and
keeps unauthenticated Requests from consuming relay state. The fixes were
found while reviewing the AMT IPv6 outer transport work; that work is not
included here.

The first patch closes the gc_wq re-arm use-after-free and makes device-stop
teardown safe for RCU readers and concurrent delayed work. The second rejects
Queries and Data from 0.0.0.0 before relay discovery. The third requires
exactly four bytes for IPv4 netlink address attributes. The fourth makes
pre-Query drops visible, avoids counting successful reports as drops, and uses
concurrent-safe TX statistics. The fifth keeps Requests stateless, authenticates
Membership Updates before allocation, keys state by address and port, bounds
per-source admission, and closes group-worker and post-stop teardown races.

v4 changes:
- Add dead-state checks and RCU protection for group and source timer workers;
  retain exactly-once device-reference release on group timer exits.
- Revalidate deferred gateway Queries against the current relay address.
- Use DEV_STATS_INC() for all AMT TX error and drop counters.
- Fold endpoint keying into authenticated allocation and keep four secret
  generations, with silent refusal at global or per-source limits.
- Document the Request-only timer lifetime in the intermediate patch and wrap
  the new comments for the netdev linter.

Validation: GCC W=1 object builds with IPv6 enabled and disabled, Clang W=1
object build, and a KASAN + lockdep + PROVE_RCU AMT selftest soak. The KASAN
guest passed discovery, IPv4/IPv6 forwarding, query egress, and completed the
IPv4 torture run; the IPv6 torture run was still active when the session was
interrupted.

v3: https://lore.kernel.org/netdev/20261012125943.558629-1-omar@xxxxxxxxxxxxx/
v2: https://lore.kernel.org/netdev/20261009201455.1904698-1-omar@xxxxxxxxxxxxx/
v1: https://lore.kernel.org/netdev/20261008003606.3666617-1-omar@xxxxxxxxxxxxx/

Assisted-by: LLM

Omar Ramadan (5):
  amt: fix use-after-free when a Membership Update re-arms a freed
    tunnel
  amt: reject a gateway Query or Data from 0.0.0.0 before a relay is
    learned
  amt: require an exact IPv4-sized IFLA_AMT_{LOCAL,DISCOVERY}_IP
  amt: make pre-query report drops visible
  amt: harden relay authentication and teardown

 drivers/net/amt.c | 477 ++++++++++++++++++++++++++++++++++------------
 include/net/amt.h |  28 ++-
 2 files changed, 376 insertions(+), 129 deletions(-)

-- 
2.43.0