From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f47.google.com (mail-pj1-f47.google.com [209.85.216.47]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 59993340298 for ; Sat, 27 Jun 2026 03:01:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.47 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782529285; cv=none; b=N6vBTcMPF8w9HF/YRAsEjJN/4o3GL1iNJL7PqrBTeZz00FGPmJ1fzhOlZRN3mKfws7pp7xAAo+ArBBy5KM53+lq/O7cKMjjODsJHpxHJ9s+UhkQWUgUYfOshhO1DJC5g/j5nuF8B8Yj4shn348CwLXHGE/AfkpI9J7c1TlmQ0GM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782529285; c=relaxed/simple; bh=WX5NcTl/9RBDR6AzG4X1n8YOSJSYMAN+nKoH8UztRLs=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=tU94KYbo+YEVH7XtcKSGTYnYqc7nUjWCBoU3fJdjTMat4OjVSLtFVqZzpCl9R+aBf0/4iBXcS6O6LmPc7lMT1CvKbZ1VJ6bfGlx6pp6q7dE4MkUsETiEeyFJC0o0L3iSPH8gXzoJfUWZu/FNPIfhIUXtB0PZAdYyP0OlwtyY1TU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=oPjbC9W7; arc=none smtp.client-ip=209.85.216.47 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="oPjbC9W7" Received: by mail-pj1-f47.google.com with SMTP id 98e67ed59e1d1-37df416c45cso825527a91.2 for ; Fri, 26 Jun 2026 20:01:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1782529283; x=1783134083; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=rs5EJEI2WbsVC5eIkeTHDPXpdMkMH/2jOxIbFQ16Lbg=; b=oPjbC9W7adxXJgU3xlb7GX48Ng++srypTwva+vHObthmEStrsOCbe7BFXXRoCDbQ/l VChu4aenMtsQ7/YerUoBdb/tchxDnwdWF6IqQz7eUmA8kzRcZQ4oVsG76+r50o0m+QFb CJEmB6Bfp/MJTzP66oQhlFQPjCM1bN4b4xi19elAv6bJdmqRnNT/9Lf6+vzboqRS2Z+Z +iyYrluWVidXEkDqD3Sn47vHaMG1hOxTJQlzCHPhD3pY9EGTKTwUO3byktF3HaHKs2lf Df/m6et82Ja7pWjn3tyWCQg67bIc1es65ZOQiKvQWWVv/sdHUv5j0isMGsg/ozshIe3k qKJw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782529283; x=1783134083; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=rs5EJEI2WbsVC5eIkeTHDPXpdMkMH/2jOxIbFQ16Lbg=; b=S/Xn7ztDuK84xXqkNfO3iw1L4FMg1nV9v5LcIxdd+XkHFennkcQXs6mGiPdthgpbvM 62pbP5MnDhiS3oMFR09lacbjex1LkGAJhF8oHyiw+nXH910s5ITClzgX3XsLQ3JdVPE3 lnyovopenkSdPld/rb7LEVXELwA4VdLXgLjtoPGCA9vZFQ96/Go7Wx9McSKOnM0oZhoT Cg4XFZCDjGRBMcG0pp0EHrS/7c2MHoui2p9xKQv1AgyUaA4qr77Wz3DzbObx7siBtYpy 0NtuKcuO6SNu90ju7fxx9itsPU+xUlZBu9cV3sSRZut4IeqTyVYxbRKqR0t55KnS7ksY j8hg== X-Forwarded-Encrypted: i=1; AHgh+RoxGlJntU/2oJ/Wq194tXp8DU6be4HWyiDd4ikqCJhDOJXJYzKceTP9Wo78qTdvkMiSN8t3vlk2eRfeROY=@vger.kernel.org X-Gm-Message-State: AOJu0YwDDNhAMUQFCYFKonq9Md2ee/2/kpw1pwS4mvAVHSr1Zev/yOrU g+9cxoCIgKd4Mwxpw88+bc987x9tnpw1CJpMZ3xFF3lcfs1wlYeMQ/q5 X-Gm-Gg: AfdE7ckhb0dc8WQiNDqwnuOdU4E2xL4XYuwpZelf1LoeECUHrVuejIZGVdpraQUGNV4 +Owczi9By8RBevKZWI7tlFy9TaTcmLe4Q1AT14ubBrtuUmtsZlKWonO6hdvKi3vuBKBkYpMGscm 2yyM7D36v/hBXj6lEe6TcUIqdZTz3BfOprUJTrgzW4fBoztOQ8q83phM3409q5jtrM6XSyu8Wwf vA6x4yeNcNoodwscS5zQy2asnDqmPUrgKENXWzKhGtkWWdOzXQZC4avYy3uFdk3F7Ssz4JZedtW u9WH7dJa/ehrisiTROCT9DCwUWsSEJsUwFK3Dlrg1mQyTOKUjdBGVjTs9u2fx4dd6zUd1uL/9ls NdkH6dbMsXr6jHQT7OAI764YYYIAV/lix76X4ntfPkkwMkCfmZS0vsxfEO/U4jbVmNsl72FlFuW 8N6RvMKSc= X-Received: by 2002:a17:90b:17c2:b0:36d:633a:e7e5 with SMTP id 98e67ed59e1d1-37df9f3821dmr8605574a91.3.1782529283442; Fri, 26 Jun 2026 20:01:23 -0700 (PDT) Received: from localhost ([111.228.63.84]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-37df39dc6fcsm4905708a91.4.2026.06.26.20.01.19 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 26 Jun 2026 20:01:23 -0700 (PDT) From: Cen Zhang To: Steffen Klassert , Herbert Xu , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Christian Hopps Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org, baijiaju1990@gmail.com, zzzccc427@gmail.com Subject: [PATCH] xfrm: clear mode callbacks after failed mode setup Date: Sat, 27 Jun 2026 11:01:17 +0800 Message-Id: <20260627030117.2614741-1-zzzccc427@gmail.com> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit xfrm_state_gc_task can run long after a failed IPTFS state setup. In the reproduced case, __xfrm_init_state() cached x->mode_cbs, IPTFS setup returned -ENOMEM before publishing mode_data, and the temporary module reference from xfrm_get_mode_cbs() was dropped immediately. The dead state then kept x->mode_cbs until deferred GC ran after xfrm_iptfs had been unloaded. Clear x->mode_cbs when mode init or clone fails before publishing mode_data. Those states never installed mode-specific state or the long-term IPTFS module pin, so deferred GC has nothing mode-specific to destroy and must not retain a callback table pointer past the temporary lookup reference. The buggy scenario involves two paths, with each column showing the order within that path: failed setup path: 1. cache x->mode_cbs 2. mode setup fails before mode_data 3. drop the temporary module ref 4. dead state keeps x->mode_cbs cached GC/unload path: 1. xfrm_state_put() queues GC work 2. xfrm_iptfs unloads later 3. xfrm_state_gc_task runs 4. GC dereferences stale x->mode_cbs This also covers the failed clone path where clone_state() returns before publishing mode_data. Validation reproduced this kernel report: Kernel panic - not syncing: Fatal exception CONFIG_FAULT_INJECTION_STACKTRACE_FILTER=y failslab_stacktrace_filter matched xfrm_iptfs frames ack_error=-12 FAULT_INJECTION: forcing a failure BUG: unable to handle page fault Workqueue: events xfrm_state_gc_task RIP: xfrm_state_gc_task+0x142/0x650 Modules linked in: esp4_offload xfrm_user [last unloaded: xfrm_iptfs] Kernel panic - not syncing: Fatal exception Fixes: 4b3faf610cc6 ("xfrm: iptfs: add new iptfs xfrm mode impl") Assisted-by: Codex:gpt-5.5 Signed-off-by: Cen Zhang --- net/xfrm/xfrm_state.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c index c58cd024e3c6..4d95b2720894 100644 --- a/net/xfrm/xfrm_state.c +++ b/net/xfrm/xfrm_state.c @@ -2071,8 +2071,11 @@ static struct xfrm_state *xfrm_state_clone_and_setup(struct xfrm_state *orig, x->mode_cbs = orig->mode_cbs; if (x->mode_cbs && x->mode_cbs->clone_state) { - if (x->mode_cbs->clone_state(x, orig)) + if (x->mode_cbs->clone_state(x, orig)) { + if (!x->mode_data) + x->mode_cbs = NULL; goto error; + } } x->props.reqid = m->new_reqid; @@ -3291,6 +3294,8 @@ int __xfrm_init_state(struct xfrm_state *x, struct netlink_ext_ack *extack) if (x->mode_cbs->init_state) err = x->mode_cbs->init_state(x); module_put(x->mode_cbs->owner); + if (err && !x->mode_data) + x->mode_cbs = NULL; } error: return err; -- 2.43.0