[PATCH net] xfrm: reschedule NAT keepalive work for new states

[PATCH net] xfrm: reschedule NAT keepalive work for new states

[Baek Kyu, Kim]

The per-net NAT keepalive work can already be pending for a state with a
long interval when a new state with a shorter interval is added.
schedule_delayed_work(..., 0) does not move the pending deadline, so the
new state's keepalive waits for the older state's deadline.

Use mod_delayed_work() for a newly added state to run the worker
immediately and recalculate the next deadline. Keep the existing
schedule_delayed_work() behavior when a state is deleted. States without
a keepalive interval still return early.

Fixes: f531d13bdfe3 ("xfrm: support sending NAT keepalives in ESP in UDP states")
Signed-off-by: Baek Kyu, Kim <pocj8ur4in@gmail.com>
---
An arm64 QEMU/KVM test of the immediate-reschedule change showed that a
new 2-second SA sent a keepalive immediately while the original kernel
sent none for five seconds. With a virtual NAT gateway, the original
mapping expired and a 9-second inbound UDP packet was lost; the changed
kernel retained the mapping and received it. A boot test of the final
patch confirmed an immediate keepalive for the new SA and no immediate
workqueue event or later keepalive for the deleted SA. An arm64 W=1
object build passed. No physical NAT device or ESP payload was tested.

 net/xfrm/xfrm_nat_keepalive.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/net/xfrm/xfrm_nat_keepalive.c b/net/xfrm/xfrm_nat_keepalive.c
index 8ed30e6c263b66..6814f9063969ef 100644
--- a/net/xfrm/xfrm_nat_keepalive.c
+++ b/net/xfrm/xfrm_nat_keepalive.c
@@ -288,7 +288,10 @@ void xfrm_nat_keepalive_state_updated(struct xfrm_state *x)
 		return;
 
 	net = xs_net(x);
-	schedule_delayed_work(&net->xfrm.nat_keepalive_work, 0);
+	if (x->km.state == XFRM_STATE_DEAD)
+		schedule_delayed_work(&net->xfrm.nat_keepalive_work, 0);
+	else
+		mod_delayed_work(system_wq, &net->xfrm.nat_keepalive_work, 0);
 }
 
 int __net_init xfrm_nat_keepalive_net_init(struct net *net)

Re: [PATCH net] xfrm: reschedule NAT keepalive work for new states

[netdev-bot+sinfo]

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - How the issue was discovered, e.g. hit in production, hit during
   development, syzbot report, manual code inspection, LLM or static
   analysis tool scan.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.

Re: [PATCH net] xfrm: reschedule NAT keepalive work for new states

[Baek Kyu, Kim]

Hi,

The issue was identified while reviewing commit daf8e3b253aa and
inspecting the XFRM NAT keepalive work scheduling path. It was not
reported from production.

I reproduced the delayed keepalive on the original kernel, then verified
the change with arm64 QEMU/KVM and a virtual NAT gateway.

Thanks,
Baek Kyu, Kim