Re: [PATCH v2] xfrm: iptfs: hold a device reference while packets are queued

Thanks for the detailed review. The findings are valid. I have reworked the
next revision to keep the reassembly device reference through the nested
xfrm_input() processing. Reassembly and reorder window deadlines are now
tracked independently, so completing one does not strand the other or apply a
stale deadline to new state. The timer is also armed for reassembly created
from a runt.

The reference is released on every completion, timeout, abort, and teardown
path. The code uses netdev_hold() and netdev_put(), documents ownership, and
fixes the style issues. I replaced the mismatched pasted trace with a concise
description verified against the KASAN reproducer, which remains private. I
also removed the incorrect bounded lifetime claim and the self reporting
credit.

I have split the timer correction into a prerequisite patch. The resulting
series now passes the ten case KASAN and reference tracker lifecycle matrix on
both the regular kernel and the lockdep and RCU debug kernel. It also passes
the stale deadline overlap and runt created reassembly regressions. I will
coordinate the timer prerequisite before posting v3 as a new thread.

pw-bot: cr