Re: [PATCH net v3 0/2] xfrm: iptfs: fix queued receive state lifetime

[Roshan Kumar]

Thank you for the detailed reviews. I reviewed and tested the reported
paths and prepared a v4 candidate based on net. Broader build validation
is still in progress.

The timer now uses absolute monotonic deadlines, so repeated updates do
not postpone an overdue expiry on low resolution kernels. Ordered input
is serialized per SA through a bounded ready queue, preventing concurrent
reassembly replacement. The device notifier releases queued references
on unregister, and the input path rejects new holds once the device is
moving or unregistering.

The revision also delivers a completed inner packet before a later
malformed block stops parsing, advances the reorder window past the
expired empty slot, and removes the redundant device null check Jakub
identified. I tested these paths with KASAN and targeted reproductions.

On the discovery question, I first found the device lifetime bug with
syzkaller while fuzzing IP TFS using custom AGGFRAG descriptions. I then
investigated the KASAN report and reproduced the lifetime failure with
a focused TUN test.

I also removed the earlier unprivileged reachability assertion from the
commit message. The namespace smoke test confirms TUN setup but does not
verify successful XFRM state installation or IP TFS input.

I plan to post v4 as a separate thread.

pw-bot: cr