Re: [PATCH net 1/1] xfrm: drop ESP-in-TCP packets with no ingress device

[Steffen Klassert <steffen.klassert@secunet.com>]

On Sat, Jul 18, 2026 at 03:12:50PM +0800, Ren Wei wrote:
> From: Zhiling Zou <roxy520tt@gmail.com>
> 
> ESP-in-TCP receives records through the TCP strparser. handle_esp()
> restores skb->dev from the saved skb_iif before passing the packet into
> the XFRM input path.
> 
> Queued TCP data can be processed after the original ingress device has
> been removed, for example during veth or net namespace teardown. In that
> case dev_get_by_index_rcu() returns NULL. The XFRM IPv4 and IPv6 input
> paths both expect skb->dev to be valid while building the route lookup,
> so queued ESP-in-TCP data can dereference a NULL device.
> 
> Drop the packet if the saved ingress device can no longer be resolved.
> Such a packet can no longer be routed through the normal XFRM receive
> path, and this preserves the existing behaviour for packets whose ingress
> device still exists.
> 
> Fixes: e27cca96cd68 ("xfrm: add espintcp (RFC 8229)")
> Cc: stable@vger.kernel.org
> Reported-by: Vega <vega@nebusec.ai>
> Signed-off-by: Zhiling Zou <roxy520tt@gmail.com>
> Assisted-by: Codex:gpt-5.4
> Reviewed-by: Ren Wei <enjou1224z@gmail.com>

Applied, thanks a lot!