xfrm: flush all states in xfrm_state_fini
authorSabrina Dubroca <sd@queasysnail.net>
Mon, 4 Aug 2025 09:05:43 +0000 (11:05 +0200)
committerSteffen Klassert <steffen.klassert@secunet.com>
Wed, 6 Aug 2025 07:23:38 +0000 (09:23 +0200)
commit42e42562c9cfcdacf000f1b42284a4fad24f8546
treeac6d7586cbc5aa0a7965e1452465c16717b53d7b
parentd942fe13f72bec92f6c689fbd74c5ec38228c16a
xfrm: flush all states in xfrm_state_fini

While reverting commit f75a2804da39 ("xfrm: destroy xfrm_state
synchronously on net exit path"), I incorrectly changed
xfrm_state_flush's "proto" argument back to IPSEC_PROTO_ANY. This
reverts some of the changes in commit dbb2483b2a46 ("xfrm: clean up
xfrm protocol checks"), and leads to some states not being removed
when we exit the netns.

Pass 0 instead of IPSEC_PROTO_ANY from both xfrm_state_fini
xfrm6_tunnel_net_exit, so that xfrm_state_flush deletes all states.

Fixes: 2a198bbec691 ("Revert "xfrm: destroy xfrm_state synchronously on net exit path"")
Reported-by: syzbot+6641a61fe0e2e89ae8c5@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=6641a61fe0e2e89ae8c5
Tested-by: syzbot+6641a61fe0e2e89ae8c5@syzkaller.appspotmail.com
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
net/ipv6/xfrm6_tunnel.c
net/xfrm/xfrm_state.c