[PATCH net v2] espintcp: Fix race condition in espintcp_close()

[PATCH net v2] espintcp: Fix race condition in espintcp_close()

[Hyunwoo Kim]

This issue was discovered during a code audit.

After cancel_work_sync() is called from espintcp_close(), 
espintcp_tx_work() can still be scheduled from paths such as 
the Delayed ACK handler or ksoftirqd.
As a result, the espintcp_tx_work() worker may dereference a 
freed espintcp ctx or sk.

The following is a simple race scenario:

           cpu0                             cpu1

  espintcp_close()
    cancel_work_sync(&ctx->work);
                                     espintcp_write_space()
                                       schedule_work(&ctx->work);

To prevent this race condition, cancel_work_sync() is 
replaced with disable_work_sync().

Fixes: e27cca96cd68 ("xfrm: add espintcp (RFC 8229)")
Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
---
Changes in v2:
- Shorten the patch subject
- Target the net tree
- Add the bug discovery background and the race scenario to the commit message
- v1: https://lore.kernel.org/all/aZLmvv51f5Iu9G7b@v4bel/
---
 net/xfrm/espintcp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/xfrm/espintcp.c b/net/xfrm/espintcp.c
index bf744ac9d5a7..8709df716e98 100644
--- a/net/xfrm/espintcp.c
+++ b/net/xfrm/espintcp.c
@@ -536,7 +536,7 @@ static void espintcp_close(struct sock *sk, long timeout)
 	sk->sk_prot = &tcp_prot;
 	barrier();
 
-	cancel_work_sync(&ctx->work);
+	disable_work_sync(&ctx->work);
 	strp_done(&ctx->strp);
 
 	skb_queue_purge(&ctx->out_queue);
-- 
2.43.0

Re: [PATCH net v2] espintcp: Fix race condition in espintcp_close()

[Simon Horman]

+ Sabrina

On Wed, Feb 18, 2026 at 02:16:43AM +0900, Hyunwoo Kim wrote:
> This issue was discovered during a code audit.
> 
> After cancel_work_sync() is called from espintcp_close(), 
> espintcp_tx_work() can still be scheduled from paths such as 
> the Delayed ACK handler or ksoftirqd.
> As a result, the espintcp_tx_work() worker may dereference a 
> freed espintcp ctx or sk.
> 
> The following is a simple race scenario:
> 
>            cpu0                             cpu1
> 
>   espintcp_close()
>     cancel_work_sync(&ctx->work);
>                                      espintcp_write_space()
>                                        schedule_work(&ctx->work);
> 
> To prevent this race condition, cancel_work_sync() is 
> replaced with disable_work_sync().
> 
> Fixes: e27cca96cd68 ("xfrm: add espintcp (RFC 8229)")
> Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
> ---
> Changes in v2:
> - Shorten the patch subject
> - Target the net tree
> - Add the bug discovery background and the race scenario to the commit message
> - v1: https://lore.kernel.org/all/aZLmvv51f5Iu9G7b@v4bel/

Thanks for taking my review into account [1].
This version looks good to me.

Reviewed-by: Simon Horman <horms@kernel.org>

It seems that get_maintainer.pl highlights that Sabrina is also a
maintainer, so I have CCed here and left the full context of the
patch in place for her convenience.

[1] https://lore.kernel.org/netdev/aZSbSOVuRgkjeezg@v4bel/

> ---
>  net/xfrm/espintcp.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/net/xfrm/espintcp.c b/net/xfrm/espintcp.c
> index bf744ac9d5a7..8709df716e98 100644
> --- a/net/xfrm/espintcp.c
> +++ b/net/xfrm/espintcp.c
> @@ -536,7 +536,7 @@ static void espintcp_close(struct sock *sk, long timeout)
>  	sk->sk_prot = &tcp_prot;
>  	barrier();
>  
> -	cancel_work_sync(&ctx->work);
> +	disable_work_sync(&ctx->work);
>  	strp_done(&ctx->strp);
>  
>  	skb_queue_purge(&ctx->out_queue);
> -- 
> 2.43.0
> 

Re: [PATCH net v2] espintcp: Fix race condition in espintcp_close()

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Wed, 18 Feb 2026 02:16:43 +0900 you wrote:
> This issue was discovered during a code audit.
> 
> After cancel_work_sync() is called from espintcp_close(),
> espintcp_tx_work() can still be scheduled from paths such as
> the Delayed ACK handler or ksoftirqd.
> As a result, the espintcp_tx_work() worker may dereference a
> freed espintcp ctx or sk.
> 
> [...]

Here is the summary with links:
  - [net,v2] espintcp: Fix race condition in espintcp_close()
    https://git.kernel.org/netdev/net/c/e1512c1db9e8

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html