[PATCH] xfrm: hold state while flushing device GC list

[paulinsider <paulinsider@gmail.com>]

The device GC list does not hold a reference to the states it
contains. xfrm_dev_state_flush() drops xfrm_state_dev_gc_lock before
calling xfrm_dev_state_free(), so the regular GC worker can
concurrently destroy and free the entire xfrm_state. Subsequent access
through the stale pointer can corrupt memory and cause a kernel panic.

Try to pin live states with xfrm_state_hold_rcu() while holding the
device GC lock, and skip states whose reference count has already
reached zero. Drop the acquired reference after the device state
cleanup completes. Also use hlist_del_init() when removing dev_gclist
so the node is marked as unhashed after removal.

Fixes: 07b87f9eea0c ("xfrm: Fix unregister netdevice hang on hardware offload.")
Reported-by: TencentOS Corvus AI <corvus@tencent.com>
Signed-off-by: paulinsider <paulinsider@gmail.com>
---
 net/xfrm/xfrm_state.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 36a4f6793ede..01138d3d1067 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -785,7 +785,7 @@ void xfrm_dev_state_free(struct xfrm_state *x)
 	if (dev && dev->xfrmdev_ops) {
 		spin_lock_bh(&xfrm_state_dev_gc_lock);
 		if (!hlist_unhashed(&x->dev_gclist))
-			hlist_del(&x->dev_gclist);
+			hlist_del_init(&x->dev_gclist);
 		spin_unlock_bh(&xfrm_state_dev_gc_lock);
 
 		if (dev->xfrmdev_ops->xdo_dev_state_free)
@@ -1006,8 +1006,13 @@ int xfrm_dev_state_flush(struct net *net, struct net_device *dev, bool task_vali
 		xso = &x->xso;
 
 		if (xso->dev == dev) {
+			/* The device GC list does not hold a reference to x. */
+			if (!xfrm_state_hold_rcu(x))
+				continue;
+
 			spin_unlock_bh(&xfrm_state_dev_gc_lock);
 			xfrm_dev_state_free(x);
+			xfrm_state_put(x);
 			spin_lock_bh(&xfrm_state_dev_gc_lock);
 			goto restart_gc;
 		}
-- 
2.44.0