From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793214720; b=xq+Ln2vEiWAS79mI/N4PMCRlqBwzmw4/DeQyGSLHYl/n99D2OPinXlYnVJ757CftKMYd xoJvgKCL58NkSVvIGO3tLgTIAsqkGfIF3yITb9izxYGM1oRTNpSsSQumEF41z6j7q16Ru lVf83wyMa1j44t2iy4+CXTPL1JYFCgwpvMmTKnQpfq+XFNo0X/2NuuC9dto4w4jU+yQ1g Q8/wthxLIGeXh035Fzd9i0k91eon/S+uFizL4e62wszQeYjnWnUM5saXvkEKSgE0e6Ftx RNJkfmwKpALt1tMaABPaOcIEitu0CI4jyS4Kv17o5Z2fBNEfYYnkITU0rbdAbTWOQrg== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793214720; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=dsqlJfNwTwW48CplkBSQuXr9KnYzN4Y0vFKhn3IveQA=; b=xpYecfKcUhyznOfV3J9Fu6zqebKATc8xRwRheK6SN8QDnLfzJakBDlROuKqIvpKzL0eN f/cVjIv+tmvpnzSjF3RQBFHPK68zWv0Vo957l3RjvKD2+bBLDXoUJvgqWrvADetDA8FbW MMjfcskUecMpW+VaHsH5wu+nCvMkCOBmjCGevqHY4AlZljbCg4UVBxfBBhwb1wLCY+UJv Xlw+e4osPViq1+B3CNfbu/TRMgA9QLuPIHVijk71dZOLcX81R3FKc6J37t+5ZPfDlqMmP 5QNgvuagWy1lCh1IYVIATakH7C0a1QVBMUyrj3nthNET13eKljoROxPiRX0AOaM4R4g== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=I23MZGRW; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 37A59606AB01; Wed, 28 Oct 2026 19:12:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=I23MZGRW Received: by smtp.kernel.org (Postfix) with ESMTPSA id 88CBD1F01825; Wed, 28 Oct 2026 19:11:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1793214720; bh=dsqlJfNwTwW48CplkBSQuXr9KnYzN4Y0vFKhn3IveQA=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=I23MZGRWJpaRQHxZuZpP2S0vRfv6njPKyVWp3ELHJN4RBLO/EAu/K1GGZPqY93K4Z R09l4/GyohyYlUJRNaCnU02MbRSh1vAlzZViQeizRQDgtjIBMkcoenq2x2ry8mTWaH vx5kHbe7MBmPmSaWvFvgkhtsYg33TqMXR9Zyq3Xc= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Florian Westphal , Qi Tang , Steffen Klassert , Sasha Levin Subject: [PATCH 6.1 0959/1887] xfrm: hold dev ref until after transport_finish NF_HOOK Date: Wed, 28 Oct 2026 17:50:55 +0100 Message-ID: <20261028170521.231353887@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261028170459.200466217@linuxfoundation.org> References: <20261028170459.200466217@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: patches@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.1-stable review patch. If anyone has any objections, please let me know. ------------------ From: Qi Tang [ Upstream commit 1c428b03840094410c5fb6a5db30640486bbbfcb ] After async crypto completes, xfrm_input_resume() calls dev_put() immediately on re-entry before the skb reaches transport_finish. The skb->dev pointer is then used inside NF_HOOK and its okfn, which can race with device teardown. Remove the dev_put from the async resumption entry and instead drop the reference after the NF_HOOK call in transport_finish, using a saved device pointer since NF_HOOK may consume the skb. This covers NF_DROP, NF_QUEUE and NF_STOLEN paths that skip the okfn. For non-transport exits (decaps, gro, drop) and secondary async return points, release the reference inline when async is set. Suggested-by: Florian Westphal Fixes: acf568ee859f ("xfrm: Reinject transport-mode packets through tasklet") Cc: stable@vger.kernel.org Signed-off-by: Qi Tang Signed-off-by: Steffen Klassert Signed-off-by: Sasha Levin --- net/ipv4/xfrm4_input.c | 5 ++++- net/ipv6/xfrm6_input.c | 5 ++++- net/xfrm/xfrm_input.c | 15 ++++++++++++--- 3 files changed, 20 insertions(+), 5 deletions(-) diff --git a/net/ipv4/xfrm4_input.c b/net/ipv4/xfrm4_input.c index f6e90ba50b639..d05e8ff9c37bf 100644 --- a/net/ipv4/xfrm4_input.c +++ b/net/ipv4/xfrm4_input.c @@ -48,6 +48,7 @@ int xfrm4_transport_finish(struct sk_buff *skb, int async) { struct xfrm_offload *xo = xfrm_offload(skb); struct iphdr *iph = ip_hdr(skb); + struct net_device *dev = skb->dev; iph->protocol = XFRM_MODE_SKB_CB(skb)->protocol; @@ -71,8 +72,10 @@ int xfrm4_transport_finish(struct sk_buff *skb, int async) } NF_HOOK(NFPROTO_IPV4, NF_INET_PRE_ROUTING, - dev_net(skb->dev), NULL, skb, skb->dev, NULL, + dev_net(dev), NULL, skb, dev, NULL, xfrm4_rcv_encap_finish); + if (async) + dev_put(dev); return 0; } diff --git a/net/ipv6/xfrm6_input.c b/net/ipv6/xfrm6_input.c index 00d2a1b8b679e..cd96299dfe2f7 100644 --- a/net/ipv6/xfrm6_input.c +++ b/net/ipv6/xfrm6_input.c @@ -41,6 +41,7 @@ static int xfrm6_transport_finish2(struct net *net, struct sock *sk, int xfrm6_transport_finish(struct sk_buff *skb, int async) { struct xfrm_offload *xo = xfrm_offload(skb); + struct net_device *dev = skb->dev; int nhlen = skb->data - skb_network_header(skb); skb_network_header(skb)[IP6CB(skb)->nhoff] = @@ -66,8 +67,10 @@ int xfrm6_transport_finish(struct sk_buff *skb, int async) } NF_HOOK(NFPROTO_IPV6, NF_INET_PRE_ROUTING, - dev_net(skb->dev), NULL, skb, skb->dev, NULL, + dev_net(dev), NULL, skb, dev, NULL, xfrm6_transport_finish2); + if (async) + dev_put(dev); return 0; } diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c index de2e8b16b217a..b39bb4662d4b2 100644 --- a/net/xfrm/xfrm_input.c +++ b/net/xfrm/xfrm_input.c @@ -634,11 +634,14 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type) else nexthdr = x->type->input(x, skb); - if (nexthdr == -EINPROGRESS) + if (nexthdr == -EINPROGRESS) { + if (async) + dev_put(skb->dev); return 0; -resume: - dev_put(skb->dev); + } + dev_put(skb->dev); +resume: spin_lock(&x->lock); if (nexthdr < 0) { if (nexthdr == -EBADMSG) { @@ -704,6 +707,8 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type) sp->olen = 0; if (skb_valid_dst(skb)) skb_dst_drop(skb); + if (async) + dev_put(skb->dev); gro_cells_receive(&gro_cells, skb); return 0; } else { @@ -723,6 +728,8 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type) sp->olen = 0; if (skb_valid_dst(skb)) skb_dst_drop(skb); + if (async) + dev_put(skb->dev); gro_cells_receive(&gro_cells, skb); return err; } @@ -733,6 +740,8 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type) drop_unlock: spin_unlock(&x->lock); drop: + if (async) + dev_put(skb->dev); xfrm_rcv_cb(skb, family, x && x->type ? x->type->proto : nexthdr, -1); kfree_skb(skb); return 0; -- 2.53.0