Re: [PATCH net v2] xfrm: retry inexact policy lookup after node reinsertion

[Steffen Klassert <steffen.klassert@secunet.com>]

On Thu, Sep 03, 2026 at 10:57:34PM +0800, Chengfeng Ye wrote:
> An inexact policy lookup first records pointers to candidate hlist heads
> and then traverses the lists.  A concurrent policy insertion can merge
> inexact tree nodes between those operations:
> 
>   lookup                         policy insertion
>   ------                         ----------------
>   find inexact candidates
>     save obsolete hlist head
>                                  write_seqcount_begin(&bin->count)
>                                  merge inexact tree nodes
>                                    hlist_del_rcu(&policy->bydst)
>                                    reinsert policy->bydst in survivor
>                                  write_seqcount_end(&bin->count)
>   evaluate saved candidate list
>     miss the moved policy
> 
> The merge immediately reinserts the same hlist node into the surviving
> tree node.  RCU keeps the policy alive, but it does not provide a
> consistent view while its list node is moved.  A lookup that selected the
> obsolete list can observe it empty.  A lookup already traversing a moved
> policy can instead follow the next pointer rewritten by the reinsertion.
> Either case can return an incorrect IPsec policy result.
> 
> The per-bin sequence counter already brackets calls to
> xfrm_policy_inexact_insert_node(), including node merges.  The read side,
> however, currently validates the counter only while searching an
> individual rb-tree.  A successful search returns without validation, and
> the later candidate-list traversal is outside that read-side section.
> 
> Snapshot the per-bin sequence before discovering candidate heads and
> validate it after evaluating all candidate lists.   Retry the lookup if
> the inexact policy tree changes while it is being searched.
> 
> Fixes: 9cf545ebd591 ("xfrm: policy: store inexact policies in a tree ordered by destination address")
> Cc: stable@vger.kernel.org
> Signed-off-by: Chengfeng Ye <nicoyip.dev@gmail.com>

Applied, thanks a lot!