From: Hu EnZe The device GC list does not hold a reference to the states it contains. During netdevice teardown, xfrm_dev_state_flush() drops xfrm_state_dev_gc_lock before calling xfrm_dev_state_free(), so the regular GC worker can concurrently destroy and free the entire xfrm_state. Subsequent access through the stale pointer can corrupt memory and cause a kernel panic. Pin live states with xfrm_state_hold_rcu() while holding the device GC lock, and skip states whose reference count has already reached zero. Drop the acquired reference after the device state cleanup completes. Also use hlist_del_init() when removing dev_gclist so the node is marked as unhashed after removal. Fixes: 07b87f9eea0c ("xfrm: Fix unregister netdevice hang on hardware offload.") Reported-by: TencentOS Corvus AI Assisted-by: Codex:GPT-5.6-Sol Signed-off-by: Hu EnZe --- v2: - rebase onto the latest ipsec tree - use Hu EnZe for authorship and Signed-off-by - add the Assisted-by trailer for Codex - clarify the netdevice teardown trigger in the commit message - no code changes v1: https://lore.kernel.org/netdev/20260801041340.92117-1-paulinsider@gmail.com/ net/xfrm/xfrm_state.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c index 36a4f6793ede..01138d3d1067 100644 --- a/net/xfrm/xfrm_state.c +++ b/net/xfrm/xfrm_state.c @@ -785,7 +785,7 @@ void xfrm_dev_state_free(struct xfrm_state *x) if (dev && dev->xfrmdev_ops) { spin_lock_bh(&xfrm_state_dev_gc_lock); if (!hlist_unhashed(&x->dev_gclist)) - hlist_del(&x->dev_gclist); + hlist_del_init(&x->dev_gclist); spin_unlock_bh(&xfrm_state_dev_gc_lock); if (dev->xfrmdev_ops->xdo_dev_state_free) @@ -1006,8 +1006,13 @@ restart_gc: xso = &x->xso; if (xso->dev == dev) { + /* The device GC list does not hold a reference to x. */ + if (!xfrm_state_hold_rcu(x)) + continue; + spin_unlock_bh(&xfrm_state_dev_gc_lock); xfrm_dev_state_free(x); + xfrm_state_put(x); spin_lock_bh(&xfrm_state_dev_gc_lock); goto restart_gc; } base-commit: c12cbf56320fb633484ee0ca1fb7d68d6b64b213 -- 2.55.0