[PATCH net] xfrm: prevent policy_hthresh.work from racing with netns teardown

[PATCH net] xfrm: prevent policy_hthresh.work from racing with netns teardown

[Minwoo Ra]

A XFRM_MSG_NEWSPDINFO request can queue the per-net work item
policy_hthresh.work onto the system workqueue.

The queued callback, xfrm_hash_rebuild(), retrieves the enclosing
struct net via container_of(). If the net namespace is torn down
before that work runs, the associated struct net may already have
been freed, and xfrm_hash_rebuild() may then dereference stale memory.

xfrm_policy_fini() already flushes policy_hash_work during teardown,
but it does not synchronize policy_hthresh.work.

Synchronize policy_hthresh.work in xfrm_policy_fini() as well, so the
queued work cannot outlive the net namespace teardown and access a
freed struct net.

Fixes: 880a6fab8f6b ("xfrm: configure policy hash table thresholds by netlink")
Signed-off-by: Minwoo Ra <raminwo0202@gmail.com>
---
 net/xfrm/xfrm_policy.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 9e1a522ab1c5..6f0097cf28b3 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -4282,6 +4282,8 @@ static void xfrm_policy_fini(struct net *net)
 	unsigned int sz;
 	int dir;
 
+	disable_work_sync(&net->xfrm.policy_hthresh.work);
+
 	flush_work(&net->xfrm.policy_hash_work);
 #ifdef CONFIG_XFRM_SUB_POLICY
 	xfrm_policy_flush(net, XFRM_POLICY_TYPE_SUB, false);

base-commit: 99600f79b28c83c68bae199a3d8e95049a758308
-- 
2.43.0

Re: [PATCH net] xfrm: prevent policy_hthresh.work from racing with netns teardown

[Steffen Klassert]

On Sat, Mar 14, 2026 at 12:58:44AM +0900, Minwoo Ra wrote:
> A XFRM_MSG_NEWSPDINFO request can queue the per-net work item
> policy_hthresh.work onto the system workqueue.
> 
> The queued callback, xfrm_hash_rebuild(), retrieves the enclosing
> struct net via container_of(). If the net namespace is torn down
> before that work runs, the associated struct net may already have
> been freed, and xfrm_hash_rebuild() may then dereference stale memory.
> 
> xfrm_policy_fini() already flushes policy_hash_work during teardown,
> but it does not synchronize policy_hthresh.work.
> 
> Synchronize policy_hthresh.work in xfrm_policy_fini() as well, so the
> queued work cannot outlive the net namespace teardown and access a
> freed struct net.
> 
> Fixes: 880a6fab8f6b ("xfrm: configure policy hash table thresholds by netlink")
> Signed-off-by: Minwoo Ra <raminwo0202@gmail.com>

Patch applied, thanks a lot!