Re: [PATCH ipsec 0/2] xfrm: fix state lifetimes in xfrm_migrate()

[Steffen Klassert]

On Sat, Oct 31, 2026 at 12:14:53PM +0800, Cen Zhang wrote:
> xfrm_migrate() keeps the old states in x_cur[] and their successors in
> x_new[], but it does not hold a reference to every state it later
> deletes. An SA with a hard lifetime can expire and be freed by the timer
> and the state GC in that window, and the following xfrm_state_delete()
> takes the lock of freed memory:
> 
>   1/2 The success path drops the lookup references of the old states
>       before it deletes them. Delete them first.
> 
>   2/2 xfrm_state_migrate() returns the published successor without a
>       caller reference, so the rollback deletes states it does not
>       hold. Take that reference before publishing and drop it after the
>       migration commits or rolls back.
> 
> Both windows date back to the initial migration support and are reached
> by XFRM_MSG_MIGRATE and PF_KEY's SADB_X_MIGRATE.
> 
> Cen Zhang (2):
>   xfrm: keep old state references until migration deletion completes
>   xfrm: hold migrated states through rollback

Series applied, thanks a lot!