[6.12.y] Please backport 8045c0df98d4 ("xfrm: Fix dev use-after-free in xfrm async resumption")

Hello,

Please apply upstream commit 8045c0df98d4 ("xfrm: Fix dev use-after-free
in xfrm async resumption") also to 6.12.y. Stable 7.1.5 contains this in
63a300151999.

It fixes 1c428b038400 ("xfrm: hold dev ref until after transport_finish
NF_HOOK"), which is present in 6.12.y since 6.12.94. On our IPsec
gateways using xfrm interfaces this issue underflows the interface
refcount and hangs unregister_netdevice() on tunnel teardown, rekey or
system shutdown:

  unregister_netdevice: waiting for xfrm-<ifname> to become free. Usage count = -381

This leads to a complete drop of our VPN links after some hours, and
stalls the reboot for a couple of minutes waiting for devices to become
free (I remember waiting 10-15 minutes for the shutdown when remote
rebooting a gateway without physical access)

known affected: 6.12.96 and 6.12.96, known unaffected 6.12.90
Fixed in 7.1.5 via 63a300151999.

Maybe you could also consider having a look at the other longterm
releases, but I have no insight where it might apply.


Thanks,
Matthias Merz

-- 
Bei Linux geht prinzipiell alles-
den Rest nennt man Bugs. Bei Windows geht prinzipiell gar nix-
den Rest nennt man Features.