[PATCH] xfrm: disable state hash resize work on netns exit

[PATCH] xfrm: disable state hash resize work on netns exit

[Eduard Zateev]

xfrm_state_fini() flushes state_hash_work before it inspects and frees the
per-net state hash tables. A concurrent state insertion can queue another
resize while that flush is in progress. The resize worker may then replace
and free a table while teardown is still walking it.

Disable and drain state_hash_work before flushing states and freeing the
tables. This also prevents a new resize from being queued during teardown.

Fixes: f034b5d4efdf ("[XFRM]: Dynamic xfrm_state hash table sizing.")
Reported-by: syzbot+f3f4fce0609f8e91b540@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=f3f4fce0609f8e91b540
Assisted-by: LLM

Build-tested: W=1 ARCH=arm64 net/xfrm/ (out-of-tree build).
No reproducer was available to run the teardown race locally.

Signed-off-by: Eduard Zateev <hackerowskiy@gmail.com>
---
 net/xfrm/xfrm_state.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index e45aa1ed5b9..8a2e465bd73 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -3392,7 +3392,7 @@ void xfrm_state_fini(struct net *net)
 	unsigned int sz;
 	int i;
 
-	flush_work(&net->xfrm.state_hash_work);
+	disable_work_sync(&net->xfrm.state_hash_work);
 	xfrm_state_flush(net, 0, false);
 	flush_work(&xfrm_state_gc_work);
 
-- 
2.55.0

Re: [PATCH] xfrm: disable state hash resize work on netns exit

[Florian Westphal]

Eduard Zateev <hackerowskiy@gmail.com> wrote:
> xfrm_state_fini() flushes state_hash_work before it inspects and frees the
> per-net state hash tables. A concurrent state insertion can queue another
> resize while that flush is in progress. The resize worker may then replace
> and free a table while teardown is still walking it.
> 
> Disable and drain state_hash_work before flushing states and freeing the
> tables. This also prevents a new resize from being queued during teardown.
> 
> Fixes: f034b5d4efdf ("[XFRM]: Dynamic xfrm_state hash table sizing.")
> Reported-by: syzbot+f3f4fce0609f8e91b540@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=f3f4fce0609f8e91b540
> Assisted-by: LLM
> 
> Build-tested: W=1 ARCH=arm64 net/xfrm/ (out-of-tree build).
> No reproducer was available to run the teardown race locally.
>
> Signed-off-by: Eduard Zateev <hackerowskiy@gmail.com>
> ---
>  net/xfrm/xfrm_state.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
> index e45aa1ed5b9..8a2e465bd73 100644
> --- a/net/xfrm/xfrm_state.c
> +++ b/net/xfrm/xfrm_state.c
> @@ -3392,7 +3392,7 @@ void xfrm_state_fini(struct net *net)
>  	unsigned int sz;
>  	int i;
>  
> -	flush_work(&net->xfrm.state_hash_work);
> +	disable_work_sync(&net->xfrm.state_hash_work);

This is already done in xfrm_net_pre_exit().

Re: [PATCH] xfrm: disable state hash resize work on netns exit

[Eric Dumazet]

Le jeu. 22 oct. 2026 à 12:27, Eduard Zateev <hackerowskiy@gmail.com> a écrit :
>
> xfrm_state_fini() flushes state_hash_work before it inspects and frees the
> per-net state hash tables. A concurrent state insertion can queue another
> resize while that flush is in progress. The resize worker may then replace
> and free a table while teardown is still walking it.

Which concurrent state insertion ? At this point the netns refcount
is zero, there are no user sockets left, and pernet device exits
have already run. If such an insertion really existed, disabling the
work would not help: the state would land in tables we are about to
free.

More importantly, the syzbot report does not match this theory:

- The object is 64 bytes, allocated at xfrm_state_init()
  (net/xfrm/xfrm_state.c:3358), so this is the initial 8-bucket
  state_byseq table, read at bucket 0 (line 3402).

- It was freed from an RCU callback (rcu_do_batch -> rcu_free_sheaf),
  that is via kfree_rcu().

xfrm never frees these tables with kfree_rcu(). xfrm_hash_resize()
swaps the pointers, calls synchronize_rcu() and then kfree() from the
worker, so its free stack would show xfrm_hash_resize(), and
xfrm_state_fini() would read the new tables, not the old ones.

What the report shows instead is a stray kfree_rcu() on a stale
pointer to a kmalloc-64 object, issued after the slot had been
recycled for this table. The culprit is somewhere else, and the
report cannot tell us where: the kfree_rcu() sheaf fast path does not
call kasan_record_aux_stack(), so we lose the caller.

This patch therefore does not fix the bug, and the Closes: tag would
close it based on an untested theory.

Thanks.

pw-bot: rejected

Re: [PATCH] xfrm: disable state hash resize work on netns exit

[Florian Westphal]

Eduard Zateev <hackerowskiy@gmail.com> wrote:
> xfrm_state_fini() flushes state_hash_work before it inspects and frees the
> per-net state hash tables. A concurrent state insertion can queue another
> resize while that flush is in progress. The resize worker may then replace
> and free a table while teardown is still walking it.

Is that correct?  Can you explain why we can have a parallel insert
while we tear down the data structures?

If we have such a scenario, what prevents the insertion from happening
after the disable_work_sync, or after the xfrm_hash_free() calls?