[PATCH] xfrm: disable state hash resize work on netns exit

xfrm_state_fini() flushes state_hash_work before it inspects and frees the
per-net state hash tables. A concurrent state insertion can queue another
resize while that flush is in progress. The resize worker may then replace
and free a table while teardown is still walking it.

Disable and drain state_hash_work before flushing states and freeing the
tables. This also prevents a new resize from being queued during teardown.

Fixes: f034b5d4efdf ("[XFRM]: Dynamic xfrm_state hash table sizing.")
Reported-by: syzbot+f3f4fce0609f8e91b540@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=f3f4fce0609f8e91b540
Assisted-by: LLM

Build-tested: W=1 ARCH=arm64 net/xfrm/ (out-of-tree build).
No reproducer was available to run the teardown race locally.

Signed-off-by: Eduard Zateev <redacted>
---
 net/xfrm/xfrm_state.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index e45aa1ed5b9..8a2e465bd73 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c

@@ -3392,7 +3392,7 @@ void xfrm_state_fini(struct net *net)
 	unsigned int sz;
 	int i;
 
-	flush_work(&net->xfrm.state_hash_work);
+	disable_work_sync(&net->xfrm.state_hash_work);
 	xfrm_state_flush(net, 0, false);
 	flush_work(&xfrm_state_gc_work);
 

-- 
2.55.0