Re: [PATCH net] xfrm: Fix dev use-after-free in xfrm async resumption

[Steffen Klassert <steffen.klassert@secunet.com>]

On Fri, May 29, 2026 at 05:21:11PM +0800, Dong Chenchen wrote:
> xfrm async resumption hold skb->dev refcnt until after transport_finish.
> However, xfrm_rcv_cb may modify skb->dev to tunnel dev without taking
> device reference, such as vti_rcv_cb. The subsequent async resumption
> will decrement the tunnel device's reference count, which lead to uaf
> of tunnel dev and refcnt leak of orig dev as below:
> 
> unregister_netdevice: waiting for vti1 to become free. Usage count = -2
> 
> Release refcnt of the original dev after tunnel rcv modify skb->dev to
> fix it.
> 
> Fixes: 1c428b038400 ("xfrm: hold dev ref until after transport_finish NF_HOOK")
> Reported-by: Xu Chunxiao <xuchunxiao3@huawei.com>
> Signed-off-by: Dong Chenchen <dongchenchen2@huawei.com>
> ---
>  net/xfrm/xfrm_input.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
> index f65291eba1f6..c979872b6006 100644
> --- a/net/xfrm/xfrm_input.c
> +++ b/net/xfrm/xfrm_input.c
> @@ -467,6 +467,7 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
>  {
>  	const struct xfrm_state_afinfo *afinfo;
>  	struct net *net = dev_net(skb->dev);
> +	struct net_device *dev = skb->dev;
>  	int err;
>  	__be32 seq;
>  	__be32 seq_hi;
> @@ -730,6 +731,10 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
>  	if (err)
>  		goto drop;
>  
> +	if (async && skb->dev != dev) {
> +		dev_put(dev);
> +		async = 0;
> +	}
>  	nf_reset_ct(skb);
>  
>  	if (decaps) {

Sashiko found issues with this patch:

https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260529092111.1089315-1-dongchenchen2%40huawei.com

Please review!