Patch "xfrm: don't skip free of empty state in acquire policy" has been added to the 6.4-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    xfrm: don't skip free of empty state in acquire policy

to the 6.4-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     xfrm-don-t-skip-free-of-empty-state-in-acquire-polic.patch
and it can be found in the queue-6.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit dd527aa6ee1cf2b12e41a9cbf4d48e6e9bfe8cd3
Author: Leon Romanovsky <leon@xxxxxxxxxx>
Date:   Mon Jul 31 14:38:27 2023 +0300

    xfrm: don't skip free of empty state in acquire policy
    
    [ Upstream commit f3ec2b5d879ef5bbcb24678914641343cb6399a2 ]
    
    In destruction flow, the assignment of NULL to xso->dev
    caused to skip of xfrm_dev_state_free() call, which was
    called in xfrm_state_put(to_put) routine.
    
    Instead of open-coded variant of xfrm_dev_state_delete() and
    xfrm_dev_state_free(), let's use them directly.
    
    Fixes: f8a70afafc17 ("xfrm: add TX datapath support for IPsec packet offload mode")
    Signed-off-by: Leon Romanovsky <leonro@xxxxxxxxxx>
    Signed-off-by: Steffen Klassert <steffen.klassert@xxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index 151ca95dd08db..363c7d5105542 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -1984,6 +1984,7 @@ static inline void xfrm_dev_state_free(struct xfrm_state *x)
 		if (dev->xfrmdev_ops->xdo_dev_state_free)
 			dev->xfrmdev_ops->xdo_dev_state_free(x);
 		xso->dev = NULL;
+		xso->type = XFRM_DEV_OFFLOAD_UNSPECIFIED;
 		netdev_put(dev, &xso->dev_tracker);
 	}
 }
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 49e63eea841dd..bda5327bf34df 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -1324,12 +1324,8 @@ xfrm_state_find(const xfrm_address_t *daddr, const xfrm_address_t *saddr,
 			struct xfrm_dev_offload *xso = &x->xso;
 
 			if (xso->type == XFRM_DEV_OFFLOAD_PACKET) {
-				xso->dev->xfrmdev_ops->xdo_dev_state_delete(x);
-				xso->dir = 0;
-				netdev_put(xso->dev, &xso->dev_tracker);
-				xso->dev = NULL;
-				xso->real_dev = NULL;
-				xso->type = XFRM_DEV_OFFLOAD_UNSPECIFIED;
+				xfrm_dev_state_delete(x);
+				xfrm_dev_state_free(x);
 			}
 #endif
 			x->km.state = XFRM_STATE_DEAD;