[PATCH RFC] xfrm: add missing RCU read lock in xfrm_send_migrate_state()

["syzbot" <syzbot@kernel.org>]

The xfrm_nlmsg_multicast() function requires the caller to hold the RCU
read lock because it uses rcu_dereference() to safely access
net->xfrm.nlsk.

When xfrm_send_migrate_state() is called directly from the netlink message
handler xfrm_do_migrate_state(), it bypasses the xfrm_mgr callbacks which
typically acquire the RCU read lock centrally. The netlink handler only
holds the xfrm_cfg_mutex and does not hold the RCU read lock, leading to a
suspicious RCU usage warning:

WARNING: suspicious RCU usage
net/xfrm/xfrm_user.c:1630 suspicious rcu_dereference_check() usage!

Call trace:
 lockdep_rcu_suspicious+0x168/0x26c kernel/locking/lockdep.c:6876
 xfrm_nlmsg_multicast net/xfrm/xfrm_user.c:1630 [inline]
 xfrm_send_migrate_state+0x6b0/0x958 net/xfrm/xfrm_user.c:3340
 xfrm_do_migrate_state+0x1114/0x1728 net/xfrm/xfrm_user.c:3507
 xfrm_user_rcv_msg+0x4e0/0x950 net/xfrm/xfrm_user.c:3907
 netlink_rcv_skb+0x238/0x414 net/netlink/af_netlink.c:2556
 xfrm_netlink_rcv+0x80/0x9c net/xfrm/xfrm_user.c:3929

Fix this by explicitly acquiring and releasing the RCU read lock around the
xfrm_nlmsg_multicast() call in xfrm_send_migrate_state(), similar to what
is done in other direct netlink handlers like xfrm_notify_userpolicy().

Fixes: a9d155ea9b44 ("xfrm: add XFRM_MSG_MIGRATE_STATE for single SA
migration")

Fixes: a9d155ea9b44 ("xfrm: add XFRM_MSG_MIGRATE_STATE for single SA migration")
Assisted-by: Gemini:gemini-3.5-flash Gemini:gemini-3.1-pro-preview syzbot
Reported-by: syzbot+b9e97485773456b16a4a@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=b9e97485773456b16a4a
Link: https://syzkaller.appspot.com/ai_job?id=d3018c43-91ed-4b51-be71-8469c523a748
To: "David S. Miller" <davem@davemloft.net>
To: "Eric Dumazet" <edumazet@google.com>
To: "Herbert Xu" <herbert@gondor.apana.org.au>
To: "Jakub Kicinski" <kuba@kernel.org>
To: <netdev@vger.kernel.org>
To: "Paolo Abeni" <pabeni@redhat.com>
To: "Steffen Klassert" <steffen.klassert@secunet.com>
To: "Antony Antony" <antony.antony@secunet.com>
Cc: "Simon Horman" <horms@kernel.org>
Cc: <linux-kernel@vger.kernel.org>

---
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index d6db63304..0ba0614d6 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -3337,7 +3337,11 @@ static int xfrm_send_migrate_state(struct net *net,
 		return err;
 	}
 
-	return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_MIGRATE);
+	rcu_read_lock();
+	err = xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_MIGRATE);
+	rcu_read_unlock();
+
+	return err;
 }
 
 static int xfrm_do_migrate_state(struct sk_buff *skb, struct nlmsghdr *nlh,


base-commit: f5098b6bae761e346ebcd9da7f95622c04733cff
-- 
This is an AI-generated patch subject to moderation.
Reply with '#syz upstream' to Sign-off the patch as a human author
and send it to the upstream kernel mailing lists.
Reply with '#syz reject' to reject it ('#syz unreject' to undo).

See https://goo.gle/syzbot-ai-patches for information about AI-generated patches.
You can comment on the patch as usual, syzbot will try to address
the comments and send a new version of the patch if necessary.
syzbot engineers can be reached at syzkaller@googlegroups.com.