xfrm_state_fini() flushes state_hash_work before it inspects and frees the per-net state hash tables. A concurrent state insertion can queue another resize while that flush is in progress. The resize worker may then replace and free a table while teardown is still walking it. Disable and drain state_hash_work before flushing states and freeing the tables. This also prevents a new resize from being queued during teardown. Fixes: f034b5d4efdf ("[XFRM]: Dynamic xfrm_state hash table sizing.") Reported-by: syzbot+f3f4fce0609f8e91b540@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=f3f4fce0609f8e91b540 Assisted-by: LLM Build-tested: W=1 ARCH=arm64 net/xfrm/ (out-of-tree build). No reproducer was available to run the teardown race locally. Signed-off-by: Eduard Zateev --- net/xfrm/xfrm_state.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c index e45aa1ed5b9..8a2e465bd73 100644 --- a/net/xfrm/xfrm_state.c +++ b/net/xfrm/xfrm_state.c @@ -3392,7 +3392,7 @@ void xfrm_state_fini(struct net *net) unsigned int sz; int i; - flush_work(&net->xfrm.state_hash_work); + disable_work_sync(&net->xfrm.state_hash_work); xfrm_state_flush(net, 0, false); flush_work(&xfrm_state_gc_work); -- 2.55.0