[PATCH] xfrm: serialize SA activation with state deletion

[PATCH] xfrm: serialize SA activation with state deletion

[Kyle Zeng]

xfrm_add_sa() publishes a newly constructed state and arms its lifetime
timer before marking it VALID. The final VOID-to-VALID test and store
are not serialized with state deletion. If hard expiry deletes the state
between the test and the store, the store resurrects the unlinked state.

An input lookup which found the state before it was removed can then add
it to the per-CPU cache after deletion has removed the cache entries.
Once the remaining references are dropped, the cache points to freed
memory.

Take x->lock around the conditional transition, with bottom halves
disabled as in xfrm_state_delete(). This preserves DEAD if expiry won
the race. The same protection covers UPDSA when it installs a replacement
for an ACQ state.

Fixes: cc01572e2fb0 ("xfrm: Add SA to hardware at the end of xfrm_state_construct()")
Signed-off-by: Kyle Zeng <kylebot@openai.com>
---
I have a reproducer for this issue and can share via DM

 net/xfrm/xfrm_user.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index a2587c7e796b..b47e5952f619 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -1068,8 +1068,10 @@ static int xfrm_add_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
 		goto out;
 	}
 
+	spin_lock_bh(&x->lock);
 	if (x->km.state == XFRM_STATE_VOID)
 		x->km.state = XFRM_STATE_VALID;
+	spin_unlock_bh(&x->lock);
 
 	c.seq = nlh->nlmsg_seq;
 	c.portid = nlh->nlmsg_pid;

base-commit: d89e1d186ec9271bf78e62771779e9fc03bf0fc3
-- 
2.56.0

Re: [PATCH] xfrm: serialize SA activation with state deletion

[netdev-bot+sinfo]

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - How the issue was discovered, e.g. hit in production, hit during
   development, syzbot report, manual code inspection, LLM or static
   analysis tool scan.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.

Re: [PATCH] xfrm: serialize SA activation with state deletion

[Steffen Klassert]

On Thu, Oct 29, 2026 at 09:23:53PM -0700, Kyle Zeng wrote:
> xfrm_add_sa() publishes a newly constructed state and arms its lifetime
> timer before marking it VALID. The final VOID-to-VALID test and store
> are not serialized with state deletion. If hard expiry deletes the state
> between the test and the store, the store resurrects the unlinked state.
> 
> An input lookup which found the state before it was removed can then add
> it to the per-CPU cache after deletion has removed the cache entries.
> Once the remaining references are dropped, the cache points to freed
> memory.
> 
> Take x->lock around the conditional transition, with bottom halves
> disabled as in xfrm_state_delete(). This preserves DEAD if expiry won
> the race. The same protection covers UPDSA when it installs a replacement
> for an ACQ state.
> 
> Fixes: cc01572e2fb0 ("xfrm: Add SA to hardware at the end of xfrm_state_construct()")
> Signed-off-by: Kyle Zeng <kylebot@openai.com>

Applied, thanks a lot!