Re: [PATCH] xfrm: Perform a replay check after return from async codepaths

From: Herbert Xu <redacted>
Date: Wed, 21 Sep 2011 22:24:42 +1000

On Wed, Sep 21, 2011 at 01:57:27PM +0200, Steffen Klassert wrote:

quoted

Well, I've got pretty reproduceable crashes when the sender of
the IPsec packets introduces reorder, that's why I noticed this.

The problem is, that the replay check function is called before
the asynchronous crypto processing and the replay advance function
is called after resume from the asynchronous processing. So
we can submit multiple packets to the crypto layer without
updating the replay window. This means that the replay check
function accepts packets that should have been dropped, because
they are reordered and more than 'replay window size' packets
to late. This leads to a crash as we try to update the replay
window beyond the allocated bounds.

OK I see what you mean now.

Acked-by: Herbert Xu <herbert@gondor.apana.org.au>

Applied, thanks everyone.