Re: [PATCH] xfrm: disable state hash resize work on netns exit

[Eric Dumazet]

Le jeu. 22 oct. 2026 à 12:27, Eduard Zateev <hackerowskiy@xxxxxxxxx> a écrit :
>
> xfrm_state_fini() flushes state_hash_work before it inspects and frees the
> per-net state hash tables. A concurrent state insertion can queue another
> resize while that flush is in progress. The resize worker may then replace
> and free a table while teardown is still walking it.

Which concurrent state insertion ? At this point the netns refcount
is zero, there are no user sockets left, and pernet device exits
have already run. If such an insertion really existed, disabling the
work would not help: the state would land in tables we are about to
free.

More importantly, the syzbot report does not match this theory:

- The object is 64 bytes, allocated at xfrm_state_init()
  (net/xfrm/xfrm_state.c:3358), so this is the initial 8-bucket
  state_byseq table, read at bucket 0 (line 3402).

- It was freed from an RCU callback (rcu_do_batch -> rcu_free_sheaf),
  that is via kfree_rcu().

xfrm never frees these tables with kfree_rcu(). xfrm_hash_resize()
swaps the pointers, calls synchronize_rcu() and then kfree() from the
worker, so its free stack would show xfrm_hash_resize(), and
xfrm_state_fini() would read the new tables, not the old ones.

What the report shows instead is a stray kfree_rcu() on a stale
pointer to a kmalloc-64 object, issued after the slot had been
recycled for this table. The culprit is somewhere else, and the
report cannot tell us where: the kfree_rcu() sheaf fast path does not
call kasan_record_aux_stack(), so we lose the caller.

This patch therefore does not fix the bug, and the Closes: tag would
close it based on an untested theory.

Thanks.

pw-bot: rejected