IP-TFS uses xtfs->drop_timer for both partial inner-packet reassembly and the reorder-window drop timeout. Reassembly completion currently cancels the timer unconditionally. That is only correct when the reorder window is empty. If the reorder window already contains saved packets, the same timer belongs to the reorder-window state and must remain armed so the missing sequence can be considered lost and the window can advance. Only cancel drop_timer from __iptfs_reassem_done() when the reorder window has no saved packets. The existing drop_lock serializes this with the reorder-window paths, and a failed cancel remains harmless. Tested with a reproducer that completes reassembly while the reorder window contains saved packets. With this change, the reorder-window timeout remains active and the window can advance correctly when the missing sequence is not received. Fixes: 0756947654468 ("xfrm: iptfs: handle received fragmented inner packets") Assisted-by: ChatGPT:5.5-extrahigh Assisted-by: Claude:4.6-opus Signed-off-by: Lilly Aronleigh --- net/xfrm/xfrm_iptfs.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/net/xfrm/xfrm_iptfs.c b/net/xfrm/xfrm_iptfs.c index ad810d1f97c..02fbb8d781a 100644 --- a/net/xfrm/xfrm_iptfs.c +++ b/net/xfrm/xfrm_iptfs.c @@ -698,8 +698,12 @@ static void __iptfs_reassem_done(struct xfrm_iptfs_data *xtfs, bool free) { assert_spin_locked(&xtfs->drop_lock); - /* We don't care if it works locking takes care of things */ - hrtimer_try_to_cancel(&xtfs->drop_timer); + /* + * The drop timer also drives the reorder window timeout. Locking makes + * a failed cancel harmless. + */ + if (!xtfs->w_savedlen) + hrtimer_try_to_cancel(&xtfs->drop_timer); if (free) kfree_skb(xtfs->ra_newskb); xtfs->ra_newskb = NULL; -- 2.43.0