Re: [PATCH ipsec v3 1/1] xfrm: bound nat keepalive state collection
Steffen Klassert <[email protected]>
| Newsgroups | gmane.linux.kernel,gmane.linux.network,gmane.linux.kernel.stable |
|---|---|
| Message-ID | <[email protected]> |
On Mon, Aug 17, 2026 at 07:09:56PM +0000, Zihan Xi wrote:
> The v1 nat keepalive fix allocates a GFP_ATOMIC object for every state
> while collecting references for phase two. This makes the worker's
> temporary memory use depend on the number of states and lets -ENOMEM abort
> the scan.
>
> Replace the allocated list with a fixed-size batch. When the batch is full,
> return a private walk status so xfrm_state_walk() leaves a cursor; drain
> the references after the walk releases xfrm_state_lock and resume from
> the cursor. This bounds temporary memory use and avoids the allocation
> failure path.
>
> The v1 fix also moved nat_keepalive_send() out of the walk callback. Keep
> the phase-two drain BH-disabled, as required by local_lock_nested_bh()
> used by the keepalive sockets.
>
> Fixes: 763fe700b7c5 ("xfrm: avoid lock inversion in nat keepalive work")
> Cc: [email protected]
> Cc: Eyal Birger <[email protected]>
> Reported-by: Vega <[email protected]>
> Assisted-by: Codex:gpt-5.4
> Signed-off-by: Zihan Xi <[email protected]>
Applied, thanks a lot!