From nobody Fri Oct 2 08:28:38 2026 Received: from mail-wr1-f41.google.com (mail-wr1-f41.google.com [209.85.221.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4A1813BBFBA for ; Mon, 3 Aug 2026 17:06:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.41 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785776762; cv=none; b=iWYYvVbBtS6x3JmrFJztnAoyn0lwurML1anv44J5EGCfSLvgbWL4WDUnwbMrbTm9Jv5WqvSUG0NDs4dUYahbIvz+zmT1PYYNTgiYeUQUe/cxem1cS2kI6/4jc6QPd3BHz5hWzBOq8fzLQxPPBCOHfdym/rx8yoNQL6k3Pc/k9LY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785776762; c=relaxed/simple; bh=ptxOntIFwPlljFAuNIhhXdjtH2CSVaiI5tnXedt+VNk=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version:Content-Type; b=JHUqd+C6kPTKntr8JL4XRHT5SXj0FtlO/pObbpMUS8iMUC8V+TP5Z3bSatVhy7Jkams3doamiRVfYwv9AejzDyXl9/StoRZlIRpdtdNui5GJRbDi9mCiqbYjMMGEfxEyiy5lzU86bmyugWwVVWbMrrzt+sJ+Dk1F8dTQTWvgOhw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=dHIdLIBv; arc=none smtp.client-ip=209.85.221.41 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="dHIdLIBv" Received: by mail-wr1-f41.google.com with SMTP id ffacd0b85a97d-47de008b020so70872f8f.1 for ; Mon, 03 Aug 2026 10:06:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1785776759; x=1786381559; darn=vger.kernel.org; h=content-transfer-encoding:content-type:mime-version:message-id:date :subject:cc:to:from:from:to:cc:subject:date:message-id:reply-to :content-type; bh=5Bba4gcbhmr4SK0bvCYEbGznO8O2RUuHHW+hHe/3QmM=; b=dHIdLIBvZtaQSbMfG6pZZYxSxtO6XbFqzpRyIH7LCjS6OmAcHY7WkODA0I7q5GQdZ/ g5YQ6Ce7tQRAJ0GvW2Dh5Xhj8j4w1MUKPqm3WGcruolHjnqXtw4BE9AVVBHZqr1Ej9EA N1IU7vvoKLmUuJNYayK5w2rV+1pt8QGmLgjnCwAOHh3tBWQvU4N4C9oMHaMwkyi3FWSV 5a62W3SEUiwoaQMMObWCiLdZOD8r8KRa3XFDF+eTiuz6TYgO+qOVw+lzwJLmhoFIt7Zj hw8n/2XfDJZPPQYatINmRDnSlfMWRNqkzEt55BBqZhLpJG4gR+P42brFekQIu85xv4jQ 4biw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785776759; x=1786381559; h=content-transfer-encoding:content-type:mime-version:message-id:date :subject:cc:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject :date:message-id:reply-to:content-type; bh=5Bba4gcbhmr4SK0bvCYEbGznO8O2RUuHHW+hHe/3QmM=; b=TZ9fyCXIXNxZ1ijm3apSf0HwbSU2AdxPjVMq0ZBzpLnwKCEgRKgJNrwT86DPSax0jX 4k4ktNLnwkOn/+QE+izbr0pgtVL5vbtuLjs4dJqhhbBYSdYkzo3qbQKZzDYpc+WPSnsT /3mbwmPU251yQtXbu5uOEC88sCAfNZWWWkTBZOOfLAEIza36YjVxAQ/kgQh4S/aMZyGe G8+L/QnxjXrqNclkNYrT7ghk+mmnc3GkqqYZzhSA7niIMGsBJsLnwpYbAS7Vd5Rb+p5S 3LgKdZeLfaoo+CFynkeYFQcWn63xb1KN37Jxn/GM6e1z9l5efXeMD+H/DV1O3DkYcLNa d3jQ== X-Forwarded-Encrypted: i=1; AHgh+RoIO2Lkd5letJy346jFv6yiDQBjtIkmxU0SOXIs/WTJRmwmpDWtROCAFnaOqXNbOFzwF2Nkt2jD47gG5Ic=@vger.kernel.org X-Gm-Message-State: AOJu0YylxS+4FSaeMiEuR8X4sThWAY9kU6XGRE7/RnVOe3Td92yp5Nub WZv5fEPbVrYQzdhVC74d5HCE8GmlQqQsCyWmmz/DwxfbRhcu+nTslgim X-Gm-Gg: AR+sD123nxlPae9ls43JUT+S9eacL73iUa4OZX9ie7cyvhlWXnPscnSL07FUXcrbUhe 2maEOmt2CHon2OFhGRVyNTooDVvE6cL0BEMXDIxH3FPzN4fHoGqfDLZHHhRyS1cetHBWVQBQKLB ZgOY8GUl2CCZj76P6UIdYvwrjwEohu76j4c9rUkb7Wo9xP83vhwK1PWwbqTRC2BreQSjaPnUOqr jG7Mgi9yog2QSW6d7xESFdMLUYjd4F3Ds66RBw6Bg73Ojd9hpV3/yfxnqpGY+N4ntDQzvO7S60d r94FqknNkwQKrAsWiDOupwQZ47AR/1lCISXb39IY6xjKFJWwQHDfYV7WeOenerfmsu1Mw9/DsjH lA4+U7ckXVjnqSxNhXdVvZcTXXy7NALT2qQrpDAE6lQwPg3VekGj8AkdR0mndWaePTob3bhZiaV xqS7oiAYoiTR1iAGc67yLKQGr03WdpzC5SXnuheFA3EgXN1DRmWfyiQ6bLdE8mPK79B3hoo2s= X-Received: by 2002:a05:6000:310a:b0:45e:dd32:92fa with SMTP id ffacd0b85a97d-47fe81cb7ccmr577898f8f.12.1785776759310; Mon, 03 Aug 2026 10:05:59 -0700 (PDT) Received: from metepc ([46.197.185.197]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-47fd456a6cbsm30855921f8f.23.2026.08.03.10.05.57 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 03 Aug 2026 10:05:58 -0700 (PDT) From: =?UTF-8?q?=C3=96mer=20Mete=20Kaya?= To: Steffen Klassert , Herbert Xu Cc: davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, horms@kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, =?UTF-8?q?=C3=96mer=20Mete=20Kaya?= , syzbot+d3bc2f2eb498a0175940@syzkaller.appspotmail.com Subject: [PATCH] xfrm: fix suspicious RCU usage in xfrm_nlmsg_multicast Date: Mon, 3 Aug 2026 20:05:25 +0300 Message-ID: <20260803170525.1767734-1-omermetekaya0@gmail.com> X-Mailer: git-send-email 2.55.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable xfrm_nlmsg_multicast() dereferences net->xfrm.nlsk via rcu_dereference() and is documented as requiring the RCU read lock, but 11 of its 12 call sites in this file do not hold it. Move the RCU read-side critical section inside xfrm_nlmsg_multicast() itself instead of adding it to each call site individually. This is safe: xfrm_get_translator() takes its own nested RCU read lock internally, and nlmsg_multicast() is called with GFP_ATOMIC, whose only conditional yield() in netlink_broadcast_filtered() is gated on blocking being allowed, which GFP_ATOMIC never permits. The redundant rcu_read_lock()/rcu_read_unlock() pair in xfrm_notify_userpolicy(), the one caller that already took the lock, is removed accordingly. Reported-by: syzbot+d3bc2f2eb498a0175940@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=3Dd3bc2f2eb498a0175940 Signed-off-by: =C3=96mer Mete Kaya --- This patch intentionally centralizes the RCU read-side critical section in xfrm_nlmsg_multicast() rather than adding rcu_read_lock()/rcu_read_unlock() to each of the 11 affected call sites, since every caller has the same requirement. If keeping the locking at each call site better matches the subsystem's conventions, I'm happy to rework the patch accordingly. Reproduced and verified on a locally built upstream kernel (v7.2.0-rc5) under QEMU/KVM, using the syzbot-provided .config and C reproducer: the warning triggered on every run before this patch, and did not trigger over 30+ runs after. xfrm_notify_userpolicy() (exercised via "ip xfrm policy getdefault") was also verified to still work correctly after removing its now-redundant RCU lock pair. net/xfrm/xfrm_user.c | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-) diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c index d6db63304..1f683516f 100644 --- a/net/xfrm/xfrm_user.c +++ b/net/xfrm/xfrm_user.c @@ -1622,31 +1622,35 @@ static struct sk_buff *xfrm_state_netlink(struct sk= _buff *in_skb, } =20 /* A wrapper for nlmsg_multicast() checking that nlsk is still available. - * Must be called with RCU read lock. + * Takes the RCU read lock internally around the multicast. */ static inline int xfrm_nlmsg_multicast(struct net *net, struct sk_buff *sk= b, - u32 pid, unsigned int group) + u32 pid, unsigned int group) { - struct sock *nlsk =3D rcu_dereference(net->xfrm.nlsk); + struct sock *nlsk; struct xfrm_translator *xtr; + int err; =20 + rcu_read_lock(); + nlsk =3D rcu_dereference(net->xfrm.nlsk); if (!nlsk) { + rcu_read_unlock(); kfree_skb(skb); return -EPIPE; } - xtr =3D xfrm_get_translator(); if (xtr) { - int err =3D xtr->alloc_compat(skb, nlmsg_hdr(skb)); - + err =3D xtr->alloc_compat(skb, nlmsg_hdr(skb)); xfrm_put_translator(xtr); if (err) { + rcu_read_unlock(); kfree_skb(skb); return err; } } - - return nlmsg_multicast(nlsk, skb, pid, group, GFP_ATOMIC); + err =3D nlmsg_multicast(nlsk, skb, pid, group, GFP_ATOMIC); + rcu_read_unlock(); + return err; } =20 static inline unsigned int xfrm_spdinfo_msgsize(void) @@ -2536,9 +2540,7 @@ static int xfrm_notify_userpolicy(struct net *net) =20 nlmsg_end(skb, nlh); =20 - rcu_read_lock(); err =3D xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_POLICY); - rcu_read_unlock(); =20 return err; } --=20 2.55.0