Re: [PATCH net 1/2] vti: fix tunnel device use-after-free across async crypto resumption

On Thu, Oct 08, 2026 at 01:49:16AM +0000, Qihang wrote:

All real, and vti6 has the same problems.

The dev_hold()/dev_put() idea assumed the callback runs exactly once
per skb, which xfrm_input() doesn't guarantee. IPTFS frees the outer
skb on its own without any callback.

This is a IPTFS bug. If IPTFS frees the skb, it has to make sure
to run the whole destruction path including all the callbacks.

The early drop when the SA is no
longer valid happens while family is still AF_UNSPEC, so xfrm_rcv_cb()
can't find the afinfo and never calls us.

Assigning family before the early drop should fix this.

And on the success path I'd
drop the last reference before gro_cells_receive() is done with
skb->dev.

I think we should unconditionally refcount skb->dev in the
xfrm input path to fix that for now.