Re: [PATCH] xfrm: disable state hash resize work on netns exit

[Florian Westphal]

Eduard Zateev <hackerowskiy@xxxxxxxxx> wrote:
> xfrm_state_fini() flushes state_hash_work before it inspects and frees the
> per-net state hash tables. A concurrent state insertion can queue another
> resize while that flush is in progress. The resize worker may then replace
> and free a table while teardown is still walking it.
> 
> Disable and drain state_hash_work before flushing states and freeing the
> tables. This also prevents a new resize from being queued during teardown.
> 
> Fixes: f034b5d4efdf ("[XFRM]: Dynamic xfrm_state hash table sizing.")
> Reported-by: syzbot+f3f4fce0609f8e91b540@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://syzkaller.appspot.com/bug?extid=f3f4fce0609f8e91b540
> Assisted-by: LLM
> 
> Build-tested: W=1 ARCH=arm64 net/xfrm/ (out-of-tree build).
> No reproducer was available to run the teardown race locally.
>
> Signed-off-by: Eduard Zateev <hackerowskiy@xxxxxxxxx>
> ---
>  net/xfrm/xfrm_state.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
> index e45aa1ed5b9..8a2e465bd73 100644
> --- a/net/xfrm/xfrm_state.c
> +++ b/net/xfrm/xfrm_state.c
> @@ -3392,7 +3392,7 @@ void xfrm_state_fini(struct net *net)
>  	unsigned int sz;
>  	int i;
>  
> -	flush_work(&net->xfrm.state_hash_work);
> +	disable_work_sync(&net->xfrm.state_hash_work);

This is already done in xfrm_net_pre_exit().