)]}' { "commit": "f0e68014f4ac1653b2980ab76744f4dfdffdbac5", "tree": "a03186fb3f6dd52b055ef41510386c771c7c1ba5", "parents": [ "8c031a30a93c09e5f7db9499de7622d3b8b34d57" ], "author": { "name": "Cen Zhang", "email": "zzzccc427@gmail.com", "time": "Sat Oct 31 12:14:55 2026 +0800" }, "committer": { "name": "Steffen Klassert", "email": "steffen.klassert@secunet.com", "time": "Mon Nov 09 08:46:16 2026 +0100" }, "message": "xfrm: hold migrated states through rollback\n\nxfrm_migrate() needs to keep each new state alive until it either commits\nor rolls back the migration. xfrm_state_migrate() publishes the successor\nusing its initial reference as SAD ownership, then returns it without a\ncaller reference. The pointer saved in x_new[] can therefore outlive the\nstate.\n\nA legacy migration can find an existing policy with no matching templates,\ninstall a successor and then fail xfrm_policy_migrate() with -ENODATA. If\nthe successor inherits a finite hard lifetime and the migration task is\ndelayed before rollback, expiry and GC can finish first:\n\n Migration task Timer / GC\n xfrm_state_migrate()\n publish xc, arm mtimer\n save xc in x_new[]\n xfrm_policy_migrate()\n return -ENODATA\n \u003ctask delayed\u003e xfrm_timer_handler(xc)\n __xfrm_state_delete(xc)\n drop SAD reference\n xfrm_state_gc_task()\n synchronize_rcu()\n free xc\n xfrm_states_delete(x_new)\n xfrm_state_delete(xc)\n spin_lock_bh(\u0026xc-\u003elock)\n\nThe control mutex does not serialize the timer or GC, and migration holds\nno RCU read lock across this interval. Rollback consequently accesses the\nfreed state\u0027s lock. This also affects the PF_KEY migration entry, which\nuses the same helpers.\n\nTake a caller reference before installing the successor, and release it\non installation failure or after the transaction succeeds. On rollback,\ndelete the successors before dropping their caller references. This keeps\neach allocation alive even if its timer has already removed it from the\nSAD.\n\nThe reported execution used trace probes and paused the netlink migration\nbefore the rollback lock access while the normal timer and GC ran. The\nuserspace setup installed an SA with a five-second hard lifetime and a\npolicy without templates using ordinary XFRM requests.\n\nKASAN report as below:\n\n \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n BUG: KASAN: slab-use-after-free in _raw_spin_lock_bh+0x38/0x50\n Read of size 1 at addr ffff8881076d6248 by task python3/417\n\n Call Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x93/0xd0\n print_report+0xce/0x630\n kasan_report+0xe0/0x110\n __kasan_check_byte+0x36/0x50\n lock_acquire+0x113/0x2f0\n _raw_spin_lock_bh+0x38/0x50\n xfrm_state_delete+0x26/0x60\n xfrm_migrate+0x11af/0x18a0\n xfrm_do_migrate+0x797/0xad0\n xfrm_user_rcv_msg+0x3b3/0xc20\n netlink_rcv_skb+0x133/0x390\n xfrm_netlink_rcv+0x76/0x90\n netlink_unicast+0x504/0x840\n netlink_sendmsg+0x7f7/0xcf0\n __sys_sendto+0x425/0x470\n __x64_sys_sendto+0xe5/0x1c0\n do_syscall_64+0x115/0x6a0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n \u003c/TASK\u003e\n\n Allocated by task 417:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x14/0x30\n __kasan_slab_alloc+0x89/0x90\n kmem_cache_alloc_noprof+0x20b/0x5f0\n xfrm_state_alloc+0x28/0x5d0\n xfrm_state_migrate_create+0x55/0x2470\n xfrm_state_migrate+0x37/0x450\n xfrm_migrate+0x80b/0x18a0\n xfrm_do_migrate+0x797/0xad0\n xfrm_user_rcv_msg+0x3b3/0xc20\n netlink_rcv_skb+0x133/0x390\n xfrm_netlink_rcv+0x76/0x90\n netlink_unicast+0x504/0x840\n netlink_sendmsg+0x7f7/0xcf0\n __sys_sendto+0x425/0x470\n __x64_sys_sendto+0xe5/0x1c0\n do_syscall_64+0x115/0x6a0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\n Freed by task 11:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x14/0x30\n kasan_save_free_info+0x3b/0x60\n __kasan_slab_free+0x5f/0x80\n kmem_cache_free+0x242/0x580\n xfrm_state_gc_task+0x533/0x730\n process_one_work+0x908/0x19c0\n worker_thread+0x65c/0xe40\n kthread+0x34f/0x460\n ret_from_fork+0x659/0x940\n ret_from_fork_asm+0x1a/0x30\n\n The buggy address belongs to the object at ffff8881076d61c0\n which belongs to the cache xfrm_state of size 936\n The buggy address is located 136 bytes inside of\n freed 936-byte region [ffff8881076d61c0, ffff8881076d6568)\n \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nFixes: 80c9abaabf42 (\"[XFRM]: Extension for dynamic update of endpoint address(es)\")\nSigned-off-by: Cen Zhang \u003czzzccc427@gmail.com\u003e\nSigned-off-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\n", "tree_diff": [ { "type": "modify", "old_id": "39ca04432220b7fdd4b009a0fc4df08b38aec690", "old_mode": 33188, "old_path": "net/xfrm/xfrm_policy.c", "new_id": "6edf60242a80fdb2987b74dae615ca14ae63bfb6", "new_mode": 33188, "new_path": "net/xfrm/xfrm_policy.c" }, { "type": "modify", "old_id": "45a52771796b9c1ee5c5cb7225018f1507cec3a9", "old_mode": 33188, "old_path": "net/xfrm/xfrm_state.c", "new_id": "f4a4ddaeb9b3782ed50c9cb8378702d7358c8b34", "new_mode": 33188, "new_path": "net/xfrm/xfrm_state.c" } ] }