Re: [PATCH net v4 3/3] xfrm: hold the tunnel device reference across the input path

[Qihang <q.h.hack.winter@gmail.com>]

The [High] finding is valid, thanks.

__input_process_payload() reaches the drop label from several inner-packet
validation failures, and the drop label sits after the loop that delivers
the packets queued on @sublist.  When the outer skb is reused in place for
the first inner packet it is already on @sublist and carries the cached
tunnel device reference, so jumping to the drop label skipped delivery and
left both the skb and its tunnel device reference behind; the same applies
to a packet queued by iptfs_reassem_cont().

v5 drops whatever is still queued on @sublist in the drop path through
xfrm_input_drop(), so the reference is released.  The normal path already
empties @sublist, so the added loop only runs on the early-error path.

A revert-based runtime check agrees: with an aggregated IPTFS payload whose
first inner packet is complete and whose second inner packet has an invalid
IPv4 header length, v5 completes RTM_DELLINK, while the same code without
the drain leaks the reference and unregister_netdevice() waits for vti0
(Usage count = 2).

v5 sent separately.

pw-bot: cr