Re: [PATCH RFC] xfrm: add missing RCU read lock in xfrm_send_migrate_state()

#syz upstream

On Fri, Jul 31, 2026 at 10:11=E2=80=AFAM 'syzbot' via
syzkaller-upstream-moderation
<[email protected]> wrote:
>
> xfrm_nlmsg_multicast() requires the RCU read lock to be held because it
> safely dereferences the net->xfrm.nlsk pointer using rcu_dereference().
> When it is called from xfrm_send_migrate_state(), the RCU read lock is no=
t
> held, which triggers a suspicious RCU usage warning:
>
> WARNING: suspicious RCU usage
> net/xfrm/xfrm_user.c:1630 suspicious rcu_dereference_check() usage!
>
> Call Trace:
>  lockdep_rcu_suspicious+0x13f/0x1d0 kernel/locking/lockdep.c:6876
>  xfrm_nlmsg_multicast+0x1d8/0x1f0 net/xfrm/xfrm_user.c:1630
>  xfrm_send_migrate_state+0x870/0xae0 net/xfrm/xfrm_user.c:3340
>  xfrm_do_migrate_state+0x1749/0x1e90 net/xfrm/xfrm_user.c:3507
>  xfrm_user_rcv_msg+0x7a8/0xf30 net/xfrm/xfrm_user.c:3907
>
> Fix this by wrapping the xfrm_nlmsg_multicast() call in
> xfrm_send_migrate_state() with rcu_read_lock() and rcu_read_unlock().
>
> Fixes: a9d155ea9b44 ("xfrm: add XFRM_MSG_MIGRATE_STATE for single SA migr=
ation")
> Assisted-by: Gemini:gemini-3.5-flash Gemini:gemini-3.1-pro-preview syzbot
> Reported-by: [email protected]
> Closes: https://syzkaller.appspot.com/bug?extid=3Dc0e99a1aa85a286d7a3b
> Link: https://syzkaller.appspot.com/ai_job?id=3D8977f559-3a7e-4bb5-b4d6-1=
196956260b6
> To: "David S. Miller" <[email protected]>
> To: "Eric Dumazet" <[email protected]>
> To: "Herbert Xu" <[email protected]>
> To: "Jakub Kicinski" <[email protected]>
> To: <[email protected]>
> To: "Paolo Abeni" <[email protected]>
> To: "Steffen Klassert" <[email protected]>
> To: "Antony Antony" <[email protected]>
> Cc: "Simon Horman" <[email protected]>
> Cc: <[email protected]>
>
> ---
> diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
> index d6db63304..0ba0614d6 100644
> --- a/net/xfrm/xfrm_user.c
> +++ b/net/xfrm/xfrm_user.c
> @@ -3337,7 +3337,11 @@ static int xfrm_send_migrate_state(struct net *net=
,
>                 return err;
>         }
>
> -       return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_MIGRATE);
> +       rcu_read_lock();
> +       err =3D xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_MIGRATE);
> +       rcu_read_unlock();
> +
> +       return err;
>  }
>
>  static int xfrm_do_migrate_state(struct sk_buff *skb, struct nlmsghdr *n=
lh,
>
>
> base-commit: f5098b6bae761e346ebcd9da7f95622c04733cff
> --
> This is an AI-generated patch subject to moderation.
> Reply with '#syz upstream' to Sign-off the patch as a human author
> and send it to the upstream kernel mailing lists.
> Reply with '#syz reject' to reject it ('#syz unreject' to undo).
>
> See https://goo.gle/syzbot-ai-patches for information about AI-generated =
patches.
> You can comment on the patch as usual, syzbot will try to address
> the comments and send a new version of the patch if necessary.
> syzbot engineers can be reached at [email protected].
>
> --
> You received this message because you are subscribed to the Google Groups=
 "syzkaller-upstream-moderation" group.
> To unsubscribe from this group and stop receiving emails from it, send an=
 email to [email protected].
> To view this discussion visit https://groups.google.com/d/msgid/syzkaller=
-upstream-moderation/7c563560-c865-48d0-a1af-7d786d353d3c%40mail.kernel.org=
.