Re: [PATCH net] xfrm: iptfs: avoid canceling reorder-window drop timer

[Steffen Klassert <steffen.klassert@secunet.com>]

On Thu, Jul 30, 2026 at 01:12:44PM +1000, Lilly Aronleigh wrote:
> IP-TFS uses xtfs->drop_timer for both partial inner-packet
> reassembly and the reorder-window drop timeout. Reassembly completion
> currently cancels the timer unconditionally.
> 
> That is only correct when the reorder window is empty. If the reorder
> window already contains saved packets, the same timer belongs to the
> reorder-window state and must remain armed so the missing sequence can
> be considered lost and the window can advance.
> 
> Only cancel drop_timer from __iptfs_reassem_done() when the reorder
> window has no saved packets. The existing drop_lock serializes this
> with the reorder-window paths, and a failed cancel remains harmless.
> 
> Tested with a reproducer that completes reassembly while the reorder
> window contains saved packets.
> 
> With this change, the reorder-window timeout remains active and the
> window can advance correctly when the missing sequence is not received.
> 
> Fixes: 0756947654468 ("xfrm: iptfs: handle received fragmented inner packets")
> Assisted-by: ChatGPT:5.5-extrahigh
> Assisted-by: Claude:4.6-opus
> Signed-off-by: Lilly Aronleigh <lilly@aronleigh.au>

Your patch does not apply to the ipsec tree.
Please rebase onto the ipsec tree, thanks!