Re: [PATCH ipsec v3 1/1] xfrm: bound nat keepalive state collection

[Steffen Klassert <steffen.klassert@secunet.com>]

On Mon, Aug 17, 2026 at 07:09:56PM +0000, Zihan Xi wrote:
> The v1 nat keepalive fix allocates a GFP_ATOMIC object for every state
> while collecting references for phase two. This makes the worker's
> temporary memory use depend on the number of states and lets -ENOMEM abort
> the scan.
> 
> Replace the allocated list with a fixed-size batch. When the batch is full,
> return a private walk status so xfrm_state_walk() leaves a cursor; drain
> the references after the walk releases xfrm_state_lock and resume from
> the cursor. This bounds temporary memory use and avoids the allocation
> failure path.
> 
> The v1 fix also moved nat_keepalive_send() out of the walk callback. Keep
> the phase-two drain BH-disabled, as required by local_lock_nested_bh()
> used by the keepalive sockets.
> 
> Fixes: 763fe700b7c5 ("xfrm: avoid lock inversion in nat keepalive work")
> Cc: stable@vger.kernel.org
> Cc: Eyal Birger <eyal.birger@gmail.com>
> Reported-by: Vega <vega@nebusec.ai>
> Assisted-by: Codex:gpt-5.4
> Signed-off-by: Zihan Xi <zihanx@nebusec.ai>

Applied, thanks a lot!