Re: [PATCH ipsec 2/2] xfrm: Wait for RCU readers during state netns exit

[Florian Westphal <fw@strlen.de>]

Steffen Klassert <steffen.klassert@secunet.com> wrote:
> xfrm_state_fini() flushes the resize and GC work, destroys all states, and
> then frees the state hash tables and the inbound percpu state cache.
> Those objects can still be observed by concurrent RCU readers. We need
> to wait for a RCU grace period before freeing the hash tables and the
> percpu cache to avoid netns teardown racing with lockless lookups.
> 
> Fix this by adding synchronize_rcu() before freeing the state hash
> tables and the inbound percpu state cache.
> 
> Fixes: c8406998b801 ("xfrm: state: use rcu_deref and assign_pointer helpers")
> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
> ---
>  net/xfrm/xfrm_state.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
> index 1748d374abca..84fbf1591138 100644
> --- a/net/xfrm/xfrm_state.c
> +++ b/net/xfrm/xfrm_state.c
> @@ -3327,6 +3327,8 @@ void xfrm_state_fini(struct net *net)
>  	xfrm_state_flush(net, 0, false);
>  	flush_work(&xfrm_state_gc_work);
>  
> +	synchronize_rcu();
> +

xfrm_state_flush() is expected to relink all states to the gc list for
the gc worker to handle.

The xfrm state worker calls synchronize_rcu() and then frees states
on the state gc list.

What scenario does this additional synchronize_rcu() protect against?

AFAICS this one is not needed, but maybe i am missing something?