AZL-93803

In the Linux kernel, the following vulnerability has been resolved:

xfrm: move policybydst RCU sync from per-netns .exit to .preexit

The struct pernetoperations docstring in include/net/netnamespace.h explicitly warns against blocking RCU primitives in .exit handlers:

Exit methods using blocking RCU primitives, such as
synchronize_rcu(), should be implemented via exit_batch.
[...]
Please, avoid synchronize_rcu() at all, where it's possible.

Note that a combination of pre_exit() and exit() can
be used, since a synchronize_rcu() is guaranteed between
the calls.

xfrmpolicyfini() violates this: it calls synchronizercu() before freeing the policybydst hash tables (so no RCU reader is mid- traversal at free time), but runs from xfrmnetops.exit -- once per namespace -- so a cleanup_net() of N namespaces pays N full RCU grace periods serially.

Use the documented preexit/exit split. Move the policy flush (and the workqueue drains it depends on) into a new .preexit handler; xfrmpolicyfini() then runs in .exit and frees the hash tables after the synchronizercuexpedited() that cleanup_net() guarantees between the two phases. Providing O(1) RCU grace periods per batch instead of O(N).

Observed on Linux 6.18 with a workload doing unshare(CLONENEWNET) at ~13/sec sustained: cleanupnet() and the netnswq rescuer kthread both stuck in xfrmpolicyfini()'s synchronizercu(), >300k struct net accumulated in the cleanup queue, Percpu in /proc/meminfo climbed to 130+ GB on 256-CPU hosts, and memcg OOMs followed. setup_net and _putnet counts were balanced, ruling out a refcount leak.