Re: [PATCH net] xfrm: iptfs: reset runtime state when cloning SAs

[Steffen Klassert]

On Thu, May 21, 2026 at 02:07:23AM +0800, Shaomin Chen wrote:
> iptfs_clone_state() clones the IPTFS mode data with kmemdup(). This
> copies runtime objects which must not be shared with the original SA,
> including the embedded sk_buff_head, hrtimers, spinlock, and in-flight
> reassembly/reorder state.
> 
> If xfrm_state_migrate() fails after clone_state() but before the later
> init_state() call has reinitialized those fields, the cloned state can be
> destroyed by xfrm_state_gc_task() with list and timer state copied from the
> original SA. With queued packets this lets the clone splice and free skbs
> owned by the original IPTFS queue, leading to use-after-free and
> double-free reports in iptfs_destroy_state() and skb release paths.
> 
> Reinitialize the clone's runtime state before publishing it through
> x->mode_data. Because clone_state() now publishes a destroyable mode_data
> object before init_state(), take the mode callback module reference there.
> Avoid taking it again from __iptfs_init_state() for the same object.
> 
> Fixes: 0e4fbf013fa5 ("xfrm: iptfs: add user packet (tunnel ingress) handling")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Shaomin Chen <eeesssooo020@xxxxxxxxx>

Applied, thanks a lot!