From nobody Mon Sep 28 10:01:56 2026 Received: from mail-qt1-f181.google.com (mail-qt1-f181.google.com [209.85.160.181]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DA2291DE8AE for ; Mon, 24 Aug 2026 05:56:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=pass smtp.client-ip=209.85.160.181 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787551013; cv=pass; b=QgA87ONQPFrYYgAhM2a6Foi/CYMqEvXJYhbX8xBUmHUAEIU6YE2XkNS7ubxKCSA8OdqB/3KBjZma1vO7t3aXxvHz3nTZAD/gYctgjrQC6/dPNvbP2b6yWkHOu9ik5uV5z0RGDhEfFgJb/YeY+rWa+Oy5Rrnf+ngSw7K8Jbi1LGs= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787551013; c=relaxed/simple; bh=N/9gx8m/mOHBe82/8NV9/wNPFSUhoDxwkOc6O9oxnds=; h=MIME-Version:From:Date:Message-ID:Subject:To:Cc:Content-Type; b=cBC3ZEc3L/Ry36P5n/LXtmXKbXqCjgVKpNFjdT75VyTIWhtY53pfEpVxpCGg6L77r+QX+pnCwtZGRfaRz7boqq3tTFUtcXxquJXDKq3uEt+tYgWK+PLYHyyFIQSe9lYz3v2+NEdyRcC6HJuULx/TUr0ONpC7s6tvkuAgqqn3kgQ= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=aronleigh.au; spf=fail smtp.mailfrom=aronleigh.au; dkim=pass (2048-bit key) header.d=aronleigh.au header.i=@aronleigh.au header.b=Lx19QxDq; arc=pass smtp.client-ip=209.85.160.181 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=aronleigh.au Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=aronleigh.au Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=aronleigh.au header.i=@aronleigh.au header.b="Lx19QxDq" Received: by mail-qt1-f181.google.com with SMTP id d75a77b69052e-51c04bf4711so26820281cf.2 for ; Sun, 23 Aug 2026 22:56:51 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1787551011; cv=none; d=google.com; s=arc-20260327; b=s9+tJFQ/thHQe6SyBnC2QkOtAA7ngjY2rmNG6d65gFMMQPL6Sofd8W9DkGlc9cKrF8 o7EEkniGCZ69aU/2YWU9FZ70jARHlheyfqTMNX/UKy/GukjWjqFe9rRwSBXw+e7yjXeB Bj/604dKSqjQoJ/bTw/sBnc5xq/GjR+cIr7XjBFQSf9eejg1CwzBWtzRF0ztya0A9KIE LnulHVeLKBaYGT0Ub62/r3Wo/bzYE6BdHh36ucQxKR040v/+Vwjc5dRI3+EknrKTKHaH T8zH9kae2NS9R7gcYput5lHM/c7xhVEyVO9718Y99hBShuf7oMB2o1X4CbBaAot0gcma psEA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=cc:to:subject:message-id:date:from:mime-version:dkim-signature; bh=DwkO4wkkSYzO9TH3bfbEy3G+7kS1Icqyi367uHODOGY=; fh=EW4F4QhGKpKcRZMLQYaanDCi15TkoyF8tFe9XXYWRWM=; b=sKDAGMpviO8Wox31bxii96RVOPBXPWDLWgVJklnLplCs9XbXxq87DlzSUC/o9eU1/j 5F8+Izx7z6dbjYmmKCCHhsI3yzkaNLDCEoEc4d2Qoi3FQjdJnO7+nvWkJl9pz/Ic1wSr wxMwe+iV8U/12maZPhJ2UuVTEIJiTW0FNwt2G4KLv584m7iAPLvlynXnRum1HnX5YOj8 Ly9sYiZ+6KdQ4YBg71KMHHQVZEzE4ouN7tFRV7sdC4eCaU0jC9km5j5dLTGKcIjfBeCv KqsTVzP9rZdmENYm/NVNoeYwdcBLIO4TDBGKUJOsFe0zs8FumiYv6xjJMAvADD94ebWZ Dq7Q==; darn=vger.kernel.org ARC-Authentication-Results: i=1; mx.google.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=aronleigh.au; s=google; t=1787551011; x=1788155811; darn=vger.kernel.org; h=content-type:cc:to:subject:message-id:date:from:mime-version:from :to:cc:subject:date:message-id:reply-to:content-type; bh=DwkO4wkkSYzO9TH3bfbEy3G+7kS1Icqyi367uHODOGY=; b=Lx19QxDqaj0eV5TMjli9ZqgFYkoZ/Kgst27PY/hUs1S5CAiJ967or9waaiBFtUruuS xfLXDp1aYWWalaDBeDq2mYLELpuu9vlQqLy71SGT87I84WU2O8hf77aq7lVUVYVIkMmt FAvtubIkeS0rt7JvA1Ceu/GWpVmGXURqc0q/r3MmHM8jtUZE12ilxX/uq65QxdswAQWX eGyA1zNoRMTYPguThiNRbRVvGjrWR+xcTFWV86n/hu6h0UTQsJpzz8+XjNh6vmxssJKz cIenVYbGhvlcAFlmHeQekaTrCmeUMxfa1fNrkvt2hGPLm8bj1Cx68N4lfNH6c/Sjum6u e0jQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787551011; x=1788155811; h=content-type:cc:to:subject:message-id:date:from:mime-version :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to:content-type; bh=DwkO4wkkSYzO9TH3bfbEy3G+7kS1Icqyi367uHODOGY=; b=B1m+SJdO0M3uwniGtYGW5G1B1UP6gss0jenv6NoOjJRS3td/8+tskWmNSYgSHUP656 tw7L6vduydSlRQ/EEPWuXOW5tx9P3+BkfL+vMfvp0n2Qen2oYpaua51smL+we7LJlhQO /dI2meE4kPvjzHOn3CEKkaHnOHEC/QEd10haohEbC13GVJJd88Yc2subYBSm4AD/tZu+ B7DyWkqJtoL2KpNOdzIkexG4m4zsye6KjYgl860aWXIOCSDtBTPIl16gkp5OqTutt3UT bvJwiuVwiYHmbdUw0M/vCcjM/5n4nsHd3Ezy/pOmSfZzFz3k5QgKvwiz6w8qtZ72ZNb9 MHVw== X-Forwarded-Encrypted: i=1; AHgh+RpC4mU3ZOnp3g1XfSV0YHSH53glb4ZEqDL54kkNEwrHjCpLjm23lrCGQmmklzDIxRaQJjb1DHWmaoC9x+4=@vger.kernel.org X-Gm-Message-State: AFuF++nxlCjHy0PvHCU8WsoQo88ZIP0YnfumzNIZGkCnnmg7Q/UBnUU0 Oe6Jow2jsG73Kl8JQ6Bpm+7VgH/VdyUIgEHv56Je7apWfCKqpRIXY8FTALzrSXDFGbM0xe6SGLf Zqr4hpqPnvgU0DA19aMmKMtwRKcAAtekINqaSdVWFD7w= X-Gm-Gg: AR+sD13PE33TjLJ454XFHpOHonkwGuYt6YbF2DUstNTJDBgxfFagYbn/Kt9b6AhIEyF g8JyFDzNx7qsVAcfWx0EMbmmjVe5Y7rsXUCVVH8beFzXtmxgzNQ/RRWW9VCyfzSiDj8BfrKjIFS rWd/bJEvKnpfPUv1pSCr020GfTdPGGI+sNhgUriWP7SEjZ/oMrn/ea7xrItPzB/jh5A2cosLlBP 4DNkc1HHTfMATk15deL+inKaECS9Buza84s4e4cTQXIoLXc1qljzeD+4rishu8vScfetEjrmN2w muw2ViAjoeBK+R5JHxnX3PKTsC+N887x6KZ966GiuQspAGt16kZWletoa+S5yQgYf3pRTJrnIj9 8 X-Received: by 2002:ac8:584e:0:b0:51c:f8f:13e with SMTP id d75a77b69052e-52e09d1e1ccmr159696191cf.40.1787551010799; Sun, 23 Aug 2026 22:56:50 -0700 (PDT) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 From: Lilly Aronleigh Date: Mon, 24 Aug 2026 15:56:39 +1000 X-Gm-Features: AcwNN1VKhHWIURsaB_lB3DteR6xFPzaW4qSWwEijFxpCy7RHJJioocZqEyslNHc Message-ID: Subject: [PATCH v2 net] xfrm: iptfs: avoid canceling reorder-window drop timer To: Steffen Klassert , Herbert Xu Cc: "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Christian Hopps , netdev@vger.kernel.org, linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" IP-TFS uses xtfs->drop_timer for both partial inner-packet reassembly and the reorder-window drop timeout. Reassembly completion currently cancels the timer unconditionally. That is only correct when the reorder window is empty. If the reorder window already contains saved packets, the same timer belongs to the reorder-window state and must remain armed so the missing sequence can be considered lost and the window can advance. Only cancel drop_timer from __iptfs_reassem_done() when the reorder window has no saved packets. The existing drop_lock serializes this with the reorder-window paths, and a failed cancel remains harmless. Tested with a reproducer that completes reassembly while the reorder window contains saved packets. With this change, the reorder-window timeout remains active and the window can advance correctly when the missing sequence is not received. Fixes: 0756947654468 ("xfrm: iptfs: handle received fragmented inner packet= s") Assisted-by: ChatGPT:5.5-extrahigh Assisted-by: Claude:4.6-opus Signed-off-by: Lilly Aronleigh --- v2: - Rebased onto current net tree - No functional changes Link: https://lore.kernel.org/netdev/CAFrrV-O1fesaza+5_WqH8OciXRu9KKE4UsB6R= cMamDu0j2-nBA@mail.gmail.com/T/#u --- net/xfrm/xfrm_iptfs.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/net/xfrm/xfrm_iptfs.c b/net/xfrm/xfrm_iptfs.c index 6920940a35b4..23e0face2b9f 100644 --- a/net/xfrm/xfrm_iptfs.c +++ b/net/xfrm/xfrm_iptfs.c @@ -707,8 +707,12 @@ static void __iptfs_reassem_done(struct xfrm_iptfs_data *xtfs, bool free) { assert_spin_locked(&xtfs->drop_lock); - /* We don't care if it works locking takes care of things */ - hrtimer_try_to_cancel(&xtfs->drop_timer); + /* + * The drop timer also drives the reorder window timeout. Locking = makes + * a failed cancel harmless. + */ + if (!xtfs->w_savedlen) + hrtimer_try_to_cancel(&xtfs->drop_timer); if (free) kfree_skb(xtfs->ra_newskb); xtfs->ra_newskb =3D NULL; -- 2.43.0