Re: [PATCH] xfrm: serialize SA activation with state deletion

[Steffen Klassert]

On Thu, Oct 29, 2026 at 09:23:53PM -0700, Kyle Zeng wrote:
> xfrm_add_sa() publishes a newly constructed state and arms its lifetime
> timer before marking it VALID. The final VOID-to-VALID test and store
> are not serialized with state deletion. If hard expiry deletes the state
> between the test and the store, the store resurrects the unlinked state.
> 
> An input lookup which found the state before it was removed can then add
> it to the per-CPU cache after deletion has removed the cache entries.
> Once the remaining references are dropped, the cache points to freed
> memory.
> 
> Take x->lock around the conditional transition, with bottom halves
> disabled as in xfrm_state_delete(). This preserves DEAD if expiry won
> the race. The same protection covers UPDSA when it installs a replacement
> for an ACQ state.
> 
> Fixes: cc01572e2fb0 ("xfrm: Add SA to hardware at the end of xfrm_state_construct()")
> Signed-off-by: Kyle Zeng <kylebot@xxxxxxxxxx>

Applied, thanks a lot!