Re: [PATCH net 1/2] vti: fix tunnel device use-after-free across async crypto resumption

[Steffen Klassert]

On Thu, Oct 08, 2026 at 01:49:16AM +0000, Qihang wrote:
> All real, and vti6 has the same problems.
> 
> The dev_hold()/dev_put() idea assumed the callback runs exactly once
> per skb, which xfrm_input() doesn't guarantee. IPTFS frees the outer
> skb on its own without any callback.

This is a IPTFS bug. If IPTFS frees the skb, it has to make sure
to run the whole destruction path including all the callbacks.

> The early drop when the SA is no
> longer valid happens while family is still AF_UNSPEC, so xfrm_rcv_cb()
> can't find the afinfo and never calls us.

Assigning family before the early drop should fix this.

> And on the success path I'd
> drop the last reference before gro_cells_receive() is done with
> skb->dev.

I think we should unconditionally refcount skb->dev in the
xfrm input path to fix that for now.