Re: [PATCH net v2 1/1] xfrm: avoid lock inversion in nat keepalive work

On Wed, Aug 05, 2026 at 04:51:25AM +0000, Zihan Xi wrote:
> nat_keepalive_work() walks the state table while xfrm_state_walk()
> holds net->xfrm.xfrm_state_lock. Its callback then acquires x->lock,
> which conflicts with the delete path taking the same locks in reverse
> order via xfrm_state_delete() and __xfrm_state_delete(). This creates
> an AB-BA deadlock that is reported by lockdep when a NAT keepalive
> worker races with SA deletion.
> 
> Fix this by splitting keepalive handling into two phases without
> reversing the lock ordering. Walk the state table only to collect a
> bounded batch of candidate states while holding xfrm_state_lock and
> taking references on them. Then, after the walk drops xfrm_state_lock,
> process each referenced state and take x->lock in phase two.
> 
> Use a small fixed-size batch and the xfrm_state_walk() cursor to resume
> the scan when the batch fills up. This avoids per-state GFP_ATOMIC
> allocations, avoids aborting a full round on -ENOMEM, and keeps
> nat_keepalive_send() in BH-disabled context by wrapping the phase-two
> drain with local_bh_disable()/local_bh_enable().
> 
> Fixes: f531d13bdfe3 ("xfrm: support sending NAT keepalives in ESP in UDP states")
> Cc: [email protected]
> Cc: Eyal Birger <[email protected]>
> Reported-by: Vega <[email protected]>
> Assisted-by: Codex:gpt-5.4
> Signed-off-by: Zihan Xi <[email protected]>
> ---
> changes in v2:
>   - reroll on top of net cf6f8b29befb so the patch applies after the
>     nat_keepalive_send() default-case change
>   - replace the unbounded GFP_ATOMIC state list with a bounded batch
>   - keep phase-two processing in BH-disabled context with
>     local_bh_disable()/local_bh_enable()
>   - clarify the validation permission model and reproducer scope in
>     the cover letter
>   - refresh the cover letter with cf6f8b29 incremental build and PoC
>     validation results
>   - rerun decode_stacktrace.sh on an LF-normalized crash log and
>     document the decoder truncation in the cover letter
>   - add source locations for the key lockdep offsets from the same
>     unfixed vmlinux
>   - add Eyal Birger to Cc for the v2 reroll
>   - v1 Link: https://lore.kernel.org/all/[email protected]/
> 
>  net/xfrm/xfrm_nat_keepalive.c | 51 +++++++++++++++++++++++++++++------
>  1 file changed, 43 insertions(+), 8 deletions(-)

Can you please send this as fix for your original v1 patch
on top of the ipsec tree? That way I don't need to revert
your original v1 patch.