Re: [PATCH net v5 0/2] xfrm: fix async crypto (-EINPROGRESS) handling in validate_xmit_xfrm()

[Steffen Klassert <steffen.klassert@secunet.com>]

On Sun, Jun 21, 2026 at 12:03:25PM +0200, Petr Wozniak wrote:
> This series fixes how the async crypto path (-EINPROGRESS from ->xmit())
> is handled in validate_xmit_xfrm() and its callers.
> 
> Patch 1 (previously sent on its own, v1-v4) makes validate_xmit_xfrm()
> return ERR_PTR(-EINPROGRESS) instead of NULL when a packet is stolen by
> async crypto, so __dev_queue_xmit() can tell it apart from a real drop
> and stop reporting -ENOMEM on noqueue/bridge interfaces.  v5 also covers
> the GSO segment loop, as Sabrina pointed out.
> 
> Patch 2 fixes a use-after-free found while looking at that GSO loop:
> validate_xmit_xfrm() unlinks async-stolen segments but never updates the
> list head ->prev, which validate_xmit_skb_list() later dereferences.
> 
> Changes in v5:
>  - 1/2: also propagate ERR_PTR(-EINPROGRESS) from the GSO segment loop
>    (the 2nd ->xmit() call); v4 only handled the single-skb path.  Restore
>    the blank line in validate_xmit_skb_list().  Add the missing
>    maintainers to Cc. (Sabrina Dubroca)
>  - 2/2: new patch -- fix the stale skb->prev use-after-free (also flagged
>    by Sashiko)
> 
> Changes in v4:
>  - Drop bool stolen tracking and the ERR_PTR return in
>    validate_xmit_skb_list(); use IS_ERR_OR_NULL() so stolen skbs are
>    silently skipped (Sabrina Dubroca)
>  - Drop ERR_PTR(-EINPROGRESS) handling in __dev_direct_xmit() (Sabrina Dubroca)
>  - Move validate_xmit_skb() return-value comment above the function
>    (Sabrina Dubroca)
> 
> Changes in v3:
>  - validate_xmit_skb_list(): set stolen=true only for -EINPROGRESS
>    (Sabrina Dubroca)
> 
> Changes in v2:
>  - Reset rc to NET_XMIT_SUCCESS only when PTR_ERR(skb) == -EINPROGRESS
>    (Sabrina Dubroca)
> 
> Petr Wozniak (2):
>   xfrm: propagate -EINPROGRESS from validate_xmit_xfrm()
>   xfrm: fix stale skb->prev after async crypto steals a GSO segment
> 
>  net/core/dev.c         | 10 ++++++++--
>  net/xfrm/xfrm_device.c | 12 ++++++++++--
>  2 files changed, 18 insertions(+), 4 deletions(-)

Series applied, thanks a lot!