[PATCH] xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit

[PATCH] xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit

[Usama Arif]

The struct pernet_operations docstring in include/net/net_namespace.h
explicitly warns against blocking RCU primitives in .exit handlers:

    Exit methods using blocking RCU primitives, such as
    synchronize_rcu(), should be implemented via exit_batch.
    [...]
    Please, avoid synchronize_rcu() at all, where it's possible.

    Note that a combination of pre_exit() and exit() can
    be used, since a synchronize_rcu() is guaranteed between
    the calls.

xfrm_policy_fini() violates this: it calls synchronize_rcu() before
freeing the policy_bydst hash tables (so no RCU reader is mid-
traversal at free time), but runs from xfrm_net_ops.exit -- once per
namespace -- so a cleanup_net() of N namespaces pays N full RCU
grace periods serially.

Use the documented pre_exit/exit split. Move the policy flush (and
the workqueue drains it depends on) into a new .pre_exit handler;
xfrm_policy_fini() then runs in .exit and frees the hash tables
after the synchronize_rcu_expedited() that cleanup_net() guarantees
between the two phases. Providing O(1) RCU grace periods per batch
instead of O(N).

Observed on Linux 6.18 with a workload doing unshare(CLONE_NEWNET)
at ~13/sec sustained: cleanup_net() and the netns_wq rescuer kthread
both stuck in xfrm_policy_fini()'s synchronize_rcu(), >300k struct
net accumulated in the cleanup queue, Percpu in /proc/meminfo climbed
to 130+ GB on 256-CPU hosts, and memcg OOMs followed. setup_net and
__put_net counts were balanced, ruling out a refcount leak.

Fixes: 069daad4f2ae ("xfrm: Wait for RCU readers during policy netns exit")
Signed-off-by: Usama Arif <usama.arif@linux.dev>
---
 net/xfrm/xfrm_policy.c | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index c944327ce66c..edc3b4d34119 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -4276,21 +4276,21 @@ static int __net_init xfrm_policy_init(struct net *net)
 	return -ENOMEM;
 }
 
-static void xfrm_policy_fini(struct net *net)
+static void __net_exit xfrm_net_pre_exit(struct net *net)
 {
-	struct xfrm_pol_inexact_bin *b, *t;
-	unsigned int sz;
-	int dir;
-
 	disable_work_sync(&net->xfrm.policy_hthresh.work);
-
 	flush_work(&net->xfrm.policy_hash_work);
 #ifdef CONFIG_XFRM_SUB_POLICY
 	xfrm_policy_flush(net, XFRM_POLICY_TYPE_SUB, false);
 #endif
 	xfrm_policy_flush(net, XFRM_POLICY_TYPE_MAIN, false);
+}
 
-	synchronize_rcu();
+static void xfrm_policy_fini(struct net *net)
+{
+	struct xfrm_pol_inexact_bin *b, *t;
+	unsigned int sz;
+	int dir;
 
 	WARN_ON(!list_empty(&net->xfrm.policy_all));
 
@@ -4368,6 +4368,7 @@ static void __net_exit xfrm_net_exit(struct net *net)
 
 static struct pernet_operations __net_initdata xfrm_net_ops = {
 	.init = xfrm_net_init,
+	.pre_exit = xfrm_net_pre_exit,
 	.exit = xfrm_net_exit,
 };
 
-- 
2.52.0

Re: [PATCH] xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit

[Steffen Klassert]

On Thu, May 21, 2026 at 03:29:26AM -0700, Usama Arif wrote:
> The struct pernet_operations docstring in include/net/net_namespace.h
> explicitly warns against blocking RCU primitives in .exit handlers:
> 
>     Exit methods using blocking RCU primitives, such as
>     synchronize_rcu(), should be implemented via exit_batch.
>     [...]
>     Please, avoid synchronize_rcu() at all, where it's possible.
> 
>     Note that a combination of pre_exit() and exit() can
>     be used, since a synchronize_rcu() is guaranteed between
>     the calls.
> 
> xfrm_policy_fini() violates this: it calls synchronize_rcu() before
> freeing the policy_bydst hash tables (so no RCU reader is mid-
> traversal at free time), but runs from xfrm_net_ops.exit -- once per
> namespace -- so a cleanup_net() of N namespaces pays N full RCU
> grace periods serially.
> 
> Use the documented pre_exit/exit split. Move the policy flush (and
> the workqueue drains it depends on) into a new .pre_exit handler;
> xfrm_policy_fini() then runs in .exit and frees the hash tables
> after the synchronize_rcu_expedited() that cleanup_net() guarantees
> between the two phases. Providing O(1) RCU grace periods per batch
> instead of O(N).
> 
> Observed on Linux 6.18 with a workload doing unshare(CLONE_NEWNET)
> at ~13/sec sustained: cleanup_net() and the netns_wq rescuer kthread
> both stuck in xfrm_policy_fini()'s synchronize_rcu(), >300k struct
> net accumulated in the cleanup queue, Percpu in /proc/meminfo climbed
> to 130+ GB on 256-CPU hosts, and memcg OOMs followed. setup_net and
> __put_net counts were balanced, ruling out a refcount leak.
> 
> Fixes: 069daad4f2ae ("xfrm: Wait for RCU readers during policy netns exit")
> Signed-off-by: Usama Arif <usama.arif@linux.dev>

Applied, thanks Usama!

Re: [PATCH] xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit

[Usama Arif]

On 26/05/2026 11:25, Steffen Klassert wrote:
> On Thu, May 21, 2026 at 03:29:26AM -0700, Usama Arif wrote:
>> The struct pernet_operations docstring in include/net/net_namespace.h
>> explicitly warns against blocking RCU primitives in .exit handlers:
>>
>>     Exit methods using blocking RCU primitives, such as
>>     synchronize_rcu(), should be implemented via exit_batch.
>>     [...]
>>     Please, avoid synchronize_rcu() at all, where it's possible.
>>
>>     Note that a combination of pre_exit() and exit() can
>>     be used, since a synchronize_rcu() is guaranteed between
>>     the calls.
>>
>> xfrm_policy_fini() violates this: it calls synchronize_rcu() before
>> freeing the policy_bydst hash tables (so no RCU reader is mid-
>> traversal at free time), but runs from xfrm_net_ops.exit -- once per
>> namespace -- so a cleanup_net() of N namespaces pays N full RCU
>> grace periods serially.
>>
>> Use the documented pre_exit/exit split. Move the policy flush (and
>> the workqueue drains it depends on) into a new .pre_exit handler;
>> xfrm_policy_fini() then runs in .exit and frees the hash tables
>> after the synchronize_rcu_expedited() that cleanup_net() guarantees
>> between the two phases. Providing O(1) RCU grace periods per batch
>> instead of O(N).
>>
>> Observed on Linux 6.18 with a workload doing unshare(CLONE_NEWNET)
>> at ~13/sec sustained: cleanup_net() and the netns_wq rescuer kthread
>> both stuck in xfrm_policy_fini()'s synchronize_rcu(), >300k struct
>> net accumulated in the cleanup queue, Percpu in /proc/meminfo climbed
>> to 130+ GB on 256-CPU hosts, and memcg OOMs followed. setup_net and
>> __put_net counts were balanced, ruling out a refcount leak.
>>
>> Fixes: 069daad4f2ae ("xfrm: Wait for RCU readers during policy netns exit")
>> Signed-off-by: Usama Arif <usama.arif@linux.dev>
> 
> Applied, thanks Usama!


Thanks! Forgot to cc stable@vger.kernel.org

Adding it here