Re: [PATCH] xfrm: avoid stale tunnel pointers in deferred input callbacks

[Victor Nogueira <victor@mojatatu.com>]

Hi!

On 11/11/2026 06:46, Jun Yao wrote:
> IP-TFS input can be deferred while its reordering queue waits for a missing
> sequence number. The VTI receive callback stores a pointer to the tunnel in
> skb->cb, and the device can be removed and freed before the callback runs.
> 
> Keep only scalar tunnel metadata in an skb extension. The VTI callbacks
> look up the device by ifindex under RCU and check its link configuration
> before using its private data. If the VTI no longer exists, drop the
> deferred packet. Use the same metadata to preserve tunnel mark handling
> and IPv6 tunnel detection, and clear it when a new XFRM receive path starts
> and after the callback completes.
> 
> Signed-off-by: Jun Yao <yaojun8558363@gmail.com>
> 
> ---
> diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
> index 6787fcf6a..f97412b95 100644
> --- a/include/linux/skbuff.h
> +++ b/include/linux/skbuff.h
> @@ -5044,6 +5044,7 @@ enum skb_ext_id {
>   #endif
>   #ifdef CONFIG_XFRM
>   	SKB_EXT_SEC_PATH,
> +	SKB_EXT_XFRM_TUNNEL,
>   #endif
>   #if IS_ENABLED(CONFIG_NET_TC_SKB_EXT)
>   	TC_SKB_EXT,
> diff --git a/include/net/xfrm.h b/include/net/xfrm.h
> index 445223a8d..defdd4088 100644
> --- a/include/net/xfrm.h
> +++ b/include/net/xfrm.h
> [...]
>   
> -#define XFRM_TUNNEL_SKB_CB(__skb) ((struct xfrm_tunnel_skb_cb *)&((__skb)->cb[0]))
> +static inline struct xfrm_tunnel_info *
> +xfrm_tunnel_info_add(struct sk_buff *skb)
> +{
> +	return skb_ext_add(skb, SKB_EXT_XFRM_TUNNEL);
> +}
> +
> +static inline const struct xfrm_tunnel_info *
> +xfrm_tunnel_info(const struct sk_buff *skb)
> +{
> +	return skb_ext_find(skb, SKB_EXT_XFRM_TUNNEL);
> +}
> +
> +static inline void xfrm_tunnel_info_clear(struct sk_buff *skb)
> +{
> +	skb_ext_del(skb, SKB_EXT_XFRM_TUNNEL);
> +}

The above lines are causing build failures when XFRM is not enabled:

In file included from net/core/sock.c:134:
./include/net/xfrm.h: In function ‘xfrm_tunnel_info_add’:
./include/net/xfrm.h:777:33: error: ‘SKB_EXT_XFRM_TUNNEL’ undeclared 
(first use in this function); did you mean ‘DST_XFRM_TUNNEL’?
   777 |         return skb_ext_add(skb, SKB_EXT_XFRM_TUNNEL);
       |                                 ^~~~~~~~~~~~~~~~~~~
       |                                 DST_XFRM_TUNNEL
./include/net/xfrm.h:777:33: note: each undeclared identifier is 
reported only once for each function it appears in
./include/net/xfrm.h: In function ‘xfrm_tunnel_info’:
./include/net/xfrm.h:783:34: error: ‘SKB_EXT_XFRM_TUNNEL’ undeclared 
(first use in this function); did you mean ‘DST_XFRM_TUNNEL’?
   783 |         return skb_ext_find(skb, SKB_EXT_XFRM_TUNNEL);
       |                                  ^~~~~~~~~~~~~~~~~~~
       |                                  DST_XFRM_TUNNEL
./include/net/xfrm.h: In function ‘xfrm_tunnel_info_clear’:
./include/net/xfrm.h:788:26: error: ‘SKB_EXT_XFRM_TUNNEL’ undeclared 
(first use in this function); did you mean ‘DST_XFRM_TUNNEL’?
   788 |         skb_ext_del(skb, SKB_EXT_XFRM_TUNNEL);
       |                          ^~~~~~~~~~~~~~~~~~~
       |                          DST_XFRM_TUNNEL

---
pw-bot: cr