Re: [PATCH net v2 1/1] xfrm: avoid lock inversion in nat keepalive work

On Mon, Aug 17, 2026 at 3:49 PM Steffen Klassert
<[email protected]> wrote:
>
> On Wed, Aug 05, 2026 at 04:51:25AM +0000, Zihan Xi wrote:
> > nat_keepalive_work() walks the state table while xfrm_state_walk()
> > holds net->xfrm.xfrm_state_lock. Its callback then acquires x->lock,
> > which conflicts with the delete path taking the same locks in reverse
> > order via xfrm_state_delete() and __xfrm_state_delete(). This creates
> > an AB-BA deadlock that is reported by lockdep when a NAT keepalive
> > worker races with SA deletion.
> >
> > Fix this by splitting keepalive handling into two phases without
> > reversing the lock ordering. Walk the state table only to collect a
> > bounded batch of candidate states while holding xfrm_state_lock and
> > taking references on them. Then, after the walk drops xfrm_state_lock,
> > process each referenced state and take x->lock in phase two.
> >
> > Use a small fixed-size batch and the xfrm_state_walk() cursor to resume
> > the scan when the batch fills up. This avoids per-state GFP_ATOMIC
> > allocations, avoids aborting a full round on -ENOMEM, and keeps
> > nat_keepalive_send() in BH-disabled context by wrapping the phase-two
> > drain with local_bh_disable()/local_bh_enable().
> >
> > Fixes: f531d13bdfe3 ("xfrm: support sending NAT keepalives in ESP in UDP states")
> > Cc: [email protected]
> > Cc: Eyal Birger <[email protected]>
> > Reported-by: Vega <[email protected]>
> > Assisted-by: Codex:gpt-5.4
> > Signed-off-by: Zihan Xi <[email protected]>
> > ---
> > changes in v2:
> >   - reroll on top of net cf6f8b29befb so the patch applies after the
> >     nat_keepalive_send() default-case change
> >   - replace the unbounded GFP_ATOMIC state list with a bounded batch
> >   - keep phase-two processing in BH-disabled context with
> >     local_bh_disable()/local_bh_enable()
> >   - clarify the validation permission model and reproducer scope in
> >     the cover letter
> >   - refresh the cover letter with cf6f8b29 incremental build and PoC
> >     validation results
> >   - rerun decode_stacktrace.sh on an LF-normalized crash log and
> >     document the decoder truncation in the cover letter
> >   - add source locations for the key lockdep offsets from the same
> >     unfixed vmlinux
> >   - add Eyal Birger to Cc for the v2 reroll
> >   - v1 Link: https://lore.kernel.org/all/[email protected]/
> >
> >  net/xfrm/xfrm_nat_keepalive.c | 51 +++++++++++++++++++++++++++++------
> >  1 file changed, 43 insertions(+), 8 deletions(-)
>
> Can you please send this as fix for your original v1 patch
> on top of the ipsec tree? That way I don't need to revert
> your original v1 patch.

Hi Steffen,

Sure, thanks for the guidance.

I will prepare a follow-up patch on top of the ipsec tree to fix the
queued v1 implementation, instead of sending this as a full replacement
against net.

Thanks,
Zihan