Re: [PATCH] xfrm: fix suspicious RCU usage in xfrm_nlmsg_multicast

[Steffen Klassert <steffen.klassert@secunet.com>]

On Mon, Aug 03, 2026 at 08:05:25PM +0300, Ömer Mete Kaya wrote:
> xfrm_nlmsg_multicast() dereferences net->xfrm.nlsk via
> rcu_dereference() and is documented as requiring the RCU read
> lock, but 11 of its 12 call sites in this file do not hold it.
> 
> Move the RCU read-side critical section inside
> xfrm_nlmsg_multicast() itself instead of adding it to each call
> site individually. This is safe: xfrm_get_translator() takes its
> own nested RCU read lock internally, and nlmsg_multicast() is
> called with GFP_ATOMIC, whose only conditional yield() in
> netlink_broadcast_filtered() is gated on blocking being allowed,
> which GFP_ATOMIC never permits.
> 
> The redundant rcu_read_lock()/rcu_read_unlock() pair in
> xfrm_notify_userpolicy(), the one caller that already took the
> lock, is removed accordingly.
> 
> Reported-by: syzbot+d3bc2f2eb498a0175940@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=d3bc2f2eb498a0175940
> Signed-off-by: Ömer Mete Kaya <omermetekaya0@gmail.com>

Can you please add a 'Fixes:' tag to the commit message?

Thanks!