[PATCH net] xfrm: iptfs: avoid canceling reorder-window drop timer

[Lilly Aronleigh]

IP-TFS uses xtfs->drop_timer for both partial inner-packet
reassembly and the reorder-window drop timeout. Reassembly completion
currently cancels the timer unconditionally.

That is only correct when the reorder window is empty. If the reorder
window already contains saved packets, the same timer belongs to the
reorder-window state and must remain armed so the missing sequence can
be considered lost and the window can advance.

Only cancel drop_timer from __iptfs_reassem_done() when the reorder
window has no saved packets. The existing drop_lock serializes this
with the reorder-window paths, and a failed cancel remains harmless.

Tested with a reproducer that completes reassembly while the reorder
window contains saved packets.

With this change, the reorder-window timeout remains active and the
window can advance correctly when the missing sequence is not received.

Fixes: 0756947654468 ("xfrm: iptfs: handle received fragmented inner packets")
Assisted-by: ChatGPT:5.5-extrahigh
Assisted-by: Claude:4.6-opus
Signed-off-by: Lilly Aronleigh <lilly@xxxxxxxxxxxx>
---
 net/xfrm/xfrm_iptfs.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/net/xfrm/xfrm_iptfs.c b/net/xfrm/xfrm_iptfs.c
index ad810d1f97c..02fbb8d781a 100644
--- a/net/xfrm/xfrm_iptfs.c
+++ b/net/xfrm/xfrm_iptfs.c
@@ -698,8 +698,12 @@ static void __iptfs_reassem_done(struct
xfrm_iptfs_data *xtfs, bool free)
 {
        assert_spin_locked(&xtfs->drop_lock);

-       /* We don't care if it works locking takes care of things */
-       hrtimer_try_to_cancel(&xtfs->drop_timer);
+       /*
+        * The drop timer also drives the reorder window timeout. Locking makes
+        * a failed cancel harmless.
+        */
+       if (!xtfs->w_savedlen)
+               hrtimer_try_to_cancel(&xtfs->drop_timer);
        if (free)
                kfree_skb(xtfs->ra_newskb);
        xtfs->ra_newskb = NULL;
--
2.43.0