Re: [PATCH v2] xfrm: delay dev_put in xfrm_input to after transport reinject

Florian Westphal
2026-04-02T10:54:37Z

Steffen Klassert <steffen.klassert@secunet.com> wrote:
> On Tue, Mar 31, 2026 at 05:27:37PM +0800, Qi Tang wrote:
> > int xfrm4_transport_finish(struct sk_buff *skb, int async)
> > {
> > struct xfrm_offload *xo = xfrm_offload(skb);
> > @@ -74,7 +96,8 @@ int xfrm4_transport_finish(struct sk_buff *skb, int async)
> >
> > NF_HOOK(NFPROTO_IPV4, NF_INET_PRE_ROUTING,
> > dev_net(skb->dev), NULL, skb, skb->dev, NULL,
> > - xfrm4_rcv_encap_finish);
> > + async ? xfrm4_rcv_encap_finish_async :
> > + xfrm4_rcv_encap_finish);
>
> What happens if the PRE_ROUTING hook returns NF_DROP, NF_QUEUE, or
> NF_STOLEN before the okfn runs? Looks like we leak the dev refcnt
> then.

Yes, no okfn is run in those cases.
I'd suggest do drop the refcount after NF_HOOK, i.e. something like:

dev = skb->dev;

NF_HOOK(NFPROTO_IPV4, NF_INET_PRE_ROUTING,
...
if (async)
dev_put(dev);

Thats easier to follow.