Re: [PATCH net v5 0/3] xfrm: fix vti tunnel device use-after-free across async crypto resumption

[Qihang]

The findings are addressed in v7; the series changed as follows.

[High, 1/3] You are right that the decaps success exit still used
skb->dev after the reference held across the async resumption was
dropped.  v7 moves that drop below gro_cells_receive() too, so both
exits now use skb->dev before the reference is released.

[Low, 3/3] Right, the queued-skb drop also fixes a pre-existing IPTFS
leak: the parse loop can jump to the drop label before the queued skbs
are delivered.  v7 adds Fixes: 6c82d24336718 for it and mentions it in
the description.

[Medium, 3/3] The reference is held only while the outer skb exists.  For
a parked skb that is at most one drop_time (1 s by default); the drop
timer then flushes the skb and the reference is released.  The unbounded
case is the pre-existing drop-timer re-arm behaviour of the
reorder/reassembly code, which this series does not change.

pw-bot: cr