Re: [PATCH] xfrm: Perform a replay check after return from async codepaths

On Wed, Sep 21, 2011 at 11:38:58AM +0200, Steffen Klassert wrote:

When asyncronous crypto algorithms are used, there might be many
packets that passed the xfrm replay check, but the replay advance
function is not called yet for these packets. So the replay check
function would accept a replay of all of these packets. Also the
system might crash if there are more packets in async processing
than the size of the anti replay window, because the replay advance
function would try to update the replay window beyond the bounds.

This pach adds a second replay check after resuming from the async
processing to fix these issues.

Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>

Actually why does this matter? For a single SA, the processing
in xfrm_input should be completely synchronous, even when you're
using asynchronous algorithms.

Cheers,
-- 
Email: Herbert Xu [off-list ref]
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt