From c8c2c8a2bbe4319f63d029d161aaee2b17687371 Mon Sep 17 00:00:00 2001 From: Antony Antony Date: Wed, 7 Oct 2026 11:34:28 +0200 Subject: [PATCH 1/9] xfrm: state: reject mark with bits outside its mask on add A mark/mask like 0x101/0xff is silently truncated to 0x01/0xff on insert, so the exact-match lookups added later in this series (DELSA, GETSA, GETAE, NEWAE, EXPIRE, MIGRATE_STATE) could not find the SA. Reject it instead. The mark is no longer sanitized on state add. Also reject an invalid XFRMA_MARK (the new mark) in XFRM_MSG_MIGRATE_STATE. Fixes: 0b91fda3a1f0 ("xfrm: Sanitize marks before insert") Cc: # needs exact-match SA lookups from this series Signed-off-by: Antony Antony Signed-off-by: Steffen Klassert --- net/xfrm/xfrm_state.c | 3 --- net/xfrm/xfrm_user.c | 24 ++++++++++++++++++++++++ 2 files changed, 24 insertions(+), 3 deletions(-) diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c index e45aa1ed5b96..602404ffc4d4 100644 --- a/net/xfrm/xfrm_state.c +++ b/net/xfrm/xfrm_state.c @@ -1732,9 +1732,6 @@ static void __xfrm_state_insert(struct xfrm_state *x) list_add(&x->km.all, &net->xfrm.state_all); - /* Sanitize mark before store */ - x->mark.v &= x->mark.m; - h = xfrm_dst_hash(net, &x->id.daddr, &x->props.saddr, x->props.reqid, x->props.family); XFRM_STATE_INSERT(bydst, &x->bydst, diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c index a2587c7e796b..0723d791b8b7 100644 --- a/net/xfrm/xfrm_user.c +++ b/net/xfrm/xfrm_user.c @@ -314,6 +314,22 @@ static int verify_selector_prefixlen(u16 family, } } +static int verify_mark(struct nlattr **attrs, struct netlink_ext_ack *extack) +{ + const struct xfrm_mark *m; + + if (!attrs[XFRMA_MARK]) + return 0; + + m = nla_data(attrs[XFRMA_MARK]); + if ((m->v & m->m) != m->v) { + NL_SET_ERR_MSG(extack, "Invalid mark value/mask combination"); + return -EINVAL; + } + + return 0; +} + static int verify_newsa_info(struct xfrm_usersa_info *p, struct nlattr **attrs, struct netlink_ext_ack *extack) @@ -333,6 +349,10 @@ static int verify_newsa_info(struct xfrm_usersa_info *p, if (err) goto out; + err = verify_mark(attrs, extack); + if (err) + goto out; + err = -EINVAL; switch (p->id.proto) { case IPPROTO_AH: @@ -3370,6 +3390,10 @@ static int xfrm_do_migrate_state(struct sk_buff *skb, struct nlmsghdr *nlh, return err; } + err = verify_mark(attrs, extack); + if (err) + return err; + copy_from_user_migrate_state(&m, um); x = xfrm_state_lookup(net, m.old_mark.v & m.old_mark.m, From 07d7b25224f503e76e63eb6947a0b9e0da7998a8 Mon Sep 17 00:00:00 2001 From: Antony Antony Date: Wed, 7 Oct 2026 11:34:50 +0200 Subject: [PATCH 2/9] xfrm: state: reject mark with bits outside its mask on ALLOCSPI Like state add and policy add in this series, ALLOCSPI rejects a mark whose value has bits outside its mask. Fixes: bd55775c8dd6 ("xfrm: SA lookups signature with mark") Cc: # avoid breaking existing userspace ABI Signed-off-by: Antony Antony Signed-off-by: Steffen Klassert --- net/xfrm/xfrm_user.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c index 0723d791b8b7..6b53373168b0 100644 --- a/net/xfrm/xfrm_user.c +++ b/net/xfrm/xfrm_user.c @@ -1916,6 +1916,9 @@ static int xfrm_alloc_userspi(struct sk_buff *skb, struct nlmsghdr *nlh, x = NULL; + err = verify_mark(attrs, extack); + if (err) + goto out_noput; mark = xfrm_mark_get(attrs, &m); if (attrs[XFRMA_IF_ID]) From b3056e57b0657a4401349187c620d0fa1b8914c8 Mon Sep 17 00:00:00 2001 From: Antony Antony Date: Wed, 7 Oct 2026 11:35:00 +0200 Subject: [PATCH 3/9] xfrm: policy: reject mark with bits outside its mask on add Same issue as states: an invalid mark/mask is silently truncated on insert, so GETPOLICY and DELPOLICY can no longer find the policy by id. Reject it instead. The mark is no longer sanitized on policy insert. Fixes: 0b91fda3a1f0 ("xfrm: Sanitize marks before insert") Cc: # avoid breaking existing userspace ABI Signed-off-by: Antony Antony Signed-off-by: Steffen Klassert --- net/xfrm/xfrm_policy.c | 3 --- net/xfrm/xfrm_user.c | 3 +++ 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c index f6f40ba713d5..0f6fcea28bcd 100644 --- a/net/xfrm/xfrm_policy.c +++ b/net/xfrm/xfrm_policy.c @@ -1575,9 +1575,6 @@ int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl) struct xfrm_policy *delpol; struct hlist_head *chain; - /* Sanitize mark before store */ - policy->mark.v &= policy->mark.m; - spin_lock_bh(&net->xfrm.xfrm_policy_lock); chain = policy_hash_bysel(net, &policy->selector, policy->family, dir); if (chain) diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c index 6b53373168b0..c1571c7a2315 100644 --- a/net/xfrm/xfrm_user.c +++ b/net/xfrm/xfrm_user.c @@ -2307,6 +2307,9 @@ static int xfrm_add_policy(struct sk_buff *skb, struct nlmsghdr *nlh, if (err) return err; err = verify_sec_ctx_len(attrs, extack); + if (err) + return err; + err = verify_mark(attrs, extack); if (err) return err; From 6362f459bfc485d805f0439ae4566c1b014abfa4 Mon Sep 17 00:00:00 2001 From: Antony Antony Date: Wed, 7 Oct 2026 11:35:09 +0200 Subject: [PATCH 4/9] xfrm: state: exact mark/mask match for SPI-keyed control-plane SA lookups Add __xfrm_state_lookup_exact(); wire it into DELSA/GETSA, GETAE/NEWAE, EXPIRE, MIGRATE_STATE. xfrm_state_update() (UPDSA) keeps wildcard match because ALLOCSPI's larval state may be unmarked (mark 0/0), so an exact-match UPDSA would not find it and the ADD fallback would then fail with -EEXIST via xfrm_state_add(). Fixes: 3d6acfa7641f ("xfrm: SA lookups with mark") Signed-off-by: Antony Antony Signed-off-by: Steffen Klassert --- include/net/xfrm.h | 3 +++ net/xfrm/xfrm_state.c | 56 +++++++++++++++++++++++++++++++++++-------- net/xfrm/xfrm_user.c | 29 +++++++++++----------- 3 files changed, 64 insertions(+), 24 deletions(-) diff --git a/include/net/xfrm.h b/include/net/xfrm.h index a6d69aaa6cd2..9e053388aa4b 100644 --- a/include/net/xfrm.h +++ b/include/net/xfrm.h @@ -1748,6 +1748,9 @@ struct xfrm_state *xfrm_state_lookup_byaddr(struct net *net, u32 mark, const xfrm_address_t *saddr, u8 proto, unsigned short family); +struct xfrm_state *xfrm_state_lookup_exact(struct net *net, const struct xfrm_mark *mark, + const xfrm_address_t *daddr, __be32 spi, + u8 proto, unsigned short family); #ifdef CONFIG_XFRM_SUB_POLICY void xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n, unsigned short family); diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c index 602404ffc4d4..f1e04df8d501 100644 --- a/net/xfrm/xfrm_state.c +++ b/net/xfrm/xfrm_state.c @@ -1177,11 +1177,19 @@ static struct xfrm_state *__xfrm_state_lookup_all(const struct xfrm_hash_state_p return NULL; } -static struct xfrm_state *__xfrm_state_lookup(const struct xfrm_hash_state_ptrs *state_ptrs, - u32 mark, - const xfrm_address_t *daddr, - __be32 spi, u8 proto, - unsigned short family) +static bool xfrm_state_mark_matches(const struct xfrm_state *x, u32 mark, u32 mask, bool exact) +{ + if (exact) + return x->mark.v == mark && x->mark.m == mask; + return (mark & x->mark.m) == x->mark.v; +} + +static struct xfrm_state * +__xfrm_state_lookup(const struct xfrm_hash_state_ptrs *state_ptrs, + u32 mark, u32 mask, bool exact, + const xfrm_address_t *daddr, + __be32 spi, u8 proto, + unsigned short family) { unsigned int h = __xfrm_spi_hash(daddr, spi, proto, family, state_ptrs->hmask); struct xfrm_state *x; @@ -1193,7 +1201,7 @@ static struct xfrm_state *__xfrm_state_lookup(const struct xfrm_hash_state_ptrs !xfrm_addr_equal(&x->id.daddr, daddr, family)) continue; - if ((mark & x->mark.m) != x->mark.v) + if (!xfrm_state_mark_matches(x, mark, mask, exact)) continue; if (!xfrm_state_hold_rcu(x)) continue; @@ -1203,6 +1211,17 @@ static struct xfrm_state *__xfrm_state_lookup(const struct xfrm_hash_state_ptrs return NULL; } +static struct xfrm_state * +__xfrm_state_lookup_exact(const struct xfrm_hash_state_ptrs *state_ptrs, + const struct xfrm_mark *mark, + const xfrm_address_t *daddr, + __be32 spi, u8 proto, + unsigned short family) +{ + return __xfrm_state_lookup(state_ptrs, mark->v, mark->m, true, + daddr, spi, proto, family); +} + struct xfrm_state *xfrm_input_state_lookup(struct net *net, u32 mark, const xfrm_address_t *daddr, __be32 spi, u8 proto, @@ -1233,7 +1252,7 @@ struct xfrm_state *xfrm_input_state_lookup(struct net *net, u32 mark, xfrm_hash_ptrs_get(net, &state_ptrs); - x = __xfrm_state_lookup(&state_ptrs, mark, daddr, spi, proto, family); + x = __xfrm_state_lookup(&state_ptrs, mark, 0, false, daddr, spi, proto, family); if (x) { spin_lock(&net->xfrm.xfrm_state_lock); if (x->km.state != XFRM_STATE_VALID) { @@ -1283,7 +1302,7 @@ static struct xfrm_state *__xfrm_state_lookup_byaddr(const struct xfrm_hash_stat return NULL; } -static inline struct xfrm_state * +static struct xfrm_state * __xfrm_state_locate(struct xfrm_state *x, int use_spi, int family) { struct xfrm_hash_state_ptrs state_ptrs; @@ -1293,7 +1312,7 @@ __xfrm_state_locate(struct xfrm_state *x, int use_spi, int family) xfrm_hash_ptrs_get(net, &state_ptrs); if (use_spi) - return __xfrm_state_lookup(&state_ptrs, mark, &x->id.daddr, + return __xfrm_state_lookup(&state_ptrs, mark, 0, false, &x->id.daddr, x->id.spi, x->id.proto, family); else return __xfrm_state_lookup_byaddr(&state_ptrs, mark, @@ -2380,7 +2399,7 @@ xfrm_state_lookup(struct net *net, u32 mark, const xfrm_address_t *daddr, __be32 rcu_read_lock(); xfrm_hash_ptrs_get(net, &state_ptrs); - x = __xfrm_state_lookup(&state_ptrs, mark, daddr, spi, proto, family); + x = __xfrm_state_lookup(&state_ptrs, mark, 0, false, daddr, spi, proto, family); rcu_read_unlock(); return x; } @@ -2404,6 +2423,23 @@ xfrm_state_lookup_byaddr(struct net *net, u32 mark, } EXPORT_SYMBOL(xfrm_state_lookup_byaddr); +struct xfrm_state * +xfrm_state_lookup_exact(struct net *net, const struct xfrm_mark *mark, + const xfrm_address_t *daddr, __be32 spi, + u8 proto, unsigned short family) +{ + struct xfrm_hash_state_ptrs state_ptrs; + struct xfrm_state *x; + + rcu_read_lock(); + xfrm_hash_ptrs_get(net, &state_ptrs); + + x = __xfrm_state_lookup_exact(&state_ptrs, mark, daddr, spi, proto, family); + rcu_read_unlock(); + return x; +} +EXPORT_SYMBOL(xfrm_state_lookup_exact); + struct xfrm_state * xfrm_find_acq(struct net *net, const struct xfrm_mark *mark, u8 mode, u32 reqid, u32 if_id, u32 pcpu_num, u8 proto, const xfrm_address_t *daddr, diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c index c1571c7a2315..5a9f729b4fcb 100644 --- a/net/xfrm/xfrm_user.c +++ b/net/xfrm/xfrm_user.c @@ -1109,11 +1109,12 @@ static struct xfrm_state *xfrm_user_state_lookup(struct net *net, struct xfrm_state *x = NULL; struct xfrm_mark m; int err; - u32 mark = xfrm_mark_get(attrs, &m); + + xfrm_mark_get(attrs, &m); if (xfrm_id_proto_match(p->proto, IPSEC_PROTO_ANY)) { err = -ESRCH; - x = xfrm_state_lookup(net, mark, &p->daddr, p->spi, p->proto, p->family); + x = xfrm_state_lookup_exact(net, &m, &p->daddr, p->spi, p->proto, p->family); } else { xfrm_address_t *saddr = NULL; @@ -1124,7 +1125,7 @@ static struct xfrm_state *xfrm_user_state_lookup(struct net *net, } err = -ESRCH; - x = xfrm_state_lookup_byaddr(net, mark, + x = xfrm_state_lookup_byaddr(net, m.v & m.m, &p->daddr, saddr, p->proto, p->family); } @@ -2821,14 +2822,13 @@ static int xfrm_get_ae(struct sk_buff *skb, struct nlmsghdr *nlh, struct sk_buff *r_skb; int err; struct km_event c; - u32 mark; struct xfrm_mark m; struct xfrm_aevent_id *p = nlmsg_data(nlh); struct xfrm_usersa_id *id = &p->sa_id; - mark = xfrm_mark_get(attrs, &m); + xfrm_mark_get(attrs, &m); - x = xfrm_state_lookup(net, mark, &id->daddr, id->spi, id->proto, id->family); + x = xfrm_state_lookup_exact(net, &m, &id->daddr, id->spi, id->proto, id->family); if (x == NULL) return -ESRCH; @@ -2869,7 +2869,6 @@ static int xfrm_new_ae(struct sk_buff *skb, struct nlmsghdr *nlh, struct xfrm_state *x; struct km_event c; int err = -EINVAL; - u32 mark = 0; struct xfrm_mark m; struct xfrm_aevent_id *p = nlmsg_data(nlh); struct nlattr *rp = attrs[XFRMA_REPLAY_VAL]; @@ -2889,9 +2888,10 @@ static int xfrm_new_ae(struct sk_buff *skb, struct nlmsghdr *nlh, return err; } - mark = xfrm_mark_get(attrs, &m); + xfrm_mark_get(attrs, &m); - x = xfrm_state_lookup(net, mark, &p->sa_id.daddr, p->sa_id.spi, p->sa_id.proto, p->sa_id.family); + x = xfrm_state_lookup_exact(net, &m, &p->sa_id.daddr, p->sa_id.spi, + p->sa_id.proto, p->sa_id.family); if (x == NULL) return -ESRCH; @@ -3025,9 +3025,10 @@ static int xfrm_add_sa_expire(struct sk_buff *skb, struct nlmsghdr *nlh, struct xfrm_user_expire *ue = nlmsg_data(nlh); struct xfrm_usersa_info *p = &ue->state; struct xfrm_mark m; - u32 mark = xfrm_mark_get(attrs, &m); - x = xfrm_state_lookup(net, mark, &p->id.daddr, p->id.spi, p->id.proto, p->family); + xfrm_mark_get(attrs, &m); + + x = xfrm_state_lookup_exact(net, &m, &p->id.daddr, p->id.spi, p->id.proto, p->family); err = -ENOENT; if (x == NULL) @@ -3402,9 +3403,9 @@ static int xfrm_do_migrate_state(struct sk_buff *skb, struct nlmsghdr *nlh, copy_from_user_migrate_state(&m, um); - x = xfrm_state_lookup(net, m.old_mark.v & m.old_mark.m, - &um->id.daddr, um->id.spi, - um->id.proto, um->id.family); + x = xfrm_state_lookup_exact(net, &m.old_mark, + &um->id.daddr, um->id.spi, + um->id.proto, um->id.family); if (!x) { NL_SET_ERR_MSG(extack, "Can not find state"); return -ESRCH; From 3eb841b771e81e0692b3ebfc75fdb774022cc4f6 Mon Sep 17 00:00:00 2001 From: Antony Antony Date: Wed, 7 Oct 2026 11:35:27 +0200 Subject: [PATCH 5/9] xfrm: fix use-after-free of migrated state in xfrm_do_migrate_state() A concurrent delete can free the migrated state before xfrm_do_migrate_state() finishes using it. Fixes: a9d155ea9b44 ("xfrm: add XFRM_MSG_MIGRATE_STATE for single SA migration") Reported-by: Sashiko Signed-off-by: Antony Antony Signed-off-by: Steffen Klassert --- net/xfrm/xfrm_user.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c index 5a9f729b4fcb..8640838dcda0 100644 --- a/net/xfrm/xfrm_user.c +++ b/net/xfrm/xfrm_user.c @@ -3509,6 +3509,7 @@ static int xfrm_do_migrate_state(struct sk_buff *skb, struct nlmsghdr *nlh, __xfrm_state_delete(x); spin_unlock_bh(&x->lock); + xfrm_state_hold(xc); err = xfrm_state_migrate_install(x, xc, &m, extack); if (err < 0) { /* @@ -3516,6 +3517,7 @@ static int xfrm_do_migrate_state(struct sk_buff *skb, struct nlmsghdr *nlh, * free under xfrm_cfg_mutex. Both SAs are gone if it does; * restoring x would risk SN/IV reuse. */ + xfrm_state_put(xc); goto out; } @@ -3534,6 +3536,7 @@ static int xfrm_do_migrate_state(struct sk_buff *skb, struct nlmsghdr *nlh, err = 0; } + xfrm_state_put(xc); out: xfrm_state_put(x); return err; From da94223774ea012188ef76f89e0bd642b39ba517 Mon Sep 17 00:00:00 2001 From: Antony Antony Date: Wed, 7 Oct 2026 11:35:39 +0200 Subject: [PATCH 6/9] xfrm: fix hw offload state leak on xfrm_do_migrate_state() error path In the error path, the cloned state is dropped without removing its hardware offload, leaking the offloaded SA entry. Fixes: a9d155ea9b44 ("xfrm: add XFRM_MSG_MIGRATE_STATE for single SA migration") Reported-by: Sashiko Signed-off-by: Antony Antony Signed-off-by: Steffen Klassert --- net/xfrm/xfrm_user.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c index 8640838dcda0..4de8c401eb44 100644 --- a/net/xfrm/xfrm_user.c +++ b/net/xfrm/xfrm_user.c @@ -3541,6 +3541,8 @@ static int xfrm_do_migrate_state(struct sk_buff *skb, struct nlmsghdr *nlh, xfrm_state_put(x); return err; out_xc: + if (m.xuo) + xfrm_dev_state_delete(xc); xc->km.state = XFRM_STATE_DEAD; xfrm_state_put(xc); xfrm_state_put(x); From a46232c697c809aaa2b0ad18157b49d66201fd7f Mon Sep 17 00:00:00 2001 From: Antony Antony Date: Wed, 7 Oct 2026 11:35:48 +0200 Subject: [PATCH 7/9] xfrm: include mark in MIGRATE_STATE SA collision check The SA lookup tuple is (daddr, spi, proto, family, mark), but the EEXIST pre-check and the xfrm_state_insert() vs xfrm_state_add() decision only considered daddr and family, ignoring mark. A migration that only changes the mark inserts a duplicate SA tuple into the hash tables. The collision check is implemented as xfrm_state_mark_collides(), which walks the SPI hash bucket for the target tuple and excludes the state being migrated by pointer, rather than doing a separate exact-match lookup followed by a wildcard lookup and comparing the result against self. Before: root@west:~# ip xfrm state add src 10.1.1.1 dst 10.1.1.2 proto esp \ spi 0x1000 reqid 100 mode tunnel aead "rfc4106(gcm(aes))" \ 0x1111111111111111111111111111111111111111 96 \ mark 0x1 mask 0xff root@west:~# ip xfrm state add src 10.1.1.1 dst 10.1.1.2 proto esp \ spi 0x1000 reqid 100 mode tunnel aead "rfc4106(gcm(aes))" \ 0x1111111111111111111111111111111111111111 96 \ mark 0x2 mask 0xff root@west:~# ip xfrm state migrate dst 10.1.1.2 proto esp spi 0x1000 \ mark 0x1 mask 0xff \ new-dst 10.1.1.2 new-src 10.1.1.1 new-reqid 100 \ new-mark 0x2 mask 0xff ip x s src 10.1.1.1 dst 10.1.1.2 proto esp spi 0x00001000 reqid 100 mode tunnel replay-window 0 mark 0x2/0xff aead rfc4106(gcm(aes)) 0x1111111111111111111111111111111111111111 96 anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000 src 10.1.1.1 dst 10.1.1.2 proto esp spi 0x00001000 reqid 100 mode tunnel replay-window 0 mark 0x2/0xff aead rfc4106(gcm(aes)) 0x1111111111111111111111111111111111111111 96 anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000 sel src 0.0.0.0/0 dst 0.0.0.0/0 Notice two states with same mark 0x2/0xff. After: Error: New SA tuple already occupied. Fixes: a9d155ea9b44 ("xfrm: add XFRM_MSG_MIGRATE_STATE for single SA migration") Reported-by: Sashiko Signed-off-by: Antony Antony Signed-off-by: Steffen Klassert --- include/net/xfrm.h | 4 ++++ net/xfrm/xfrm_state.c | 40 +++++++++++++++++++++++++++++++++++++--- net/xfrm/xfrm_user.c | 15 +++++++-------- 3 files changed, 48 insertions(+), 11 deletions(-) diff --git a/include/net/xfrm.h b/include/net/xfrm.h index 9e053388aa4b..26dd4b570588 100644 --- a/include/net/xfrm.h +++ b/include/net/xfrm.h @@ -1751,6 +1751,10 @@ struct xfrm_state *xfrm_state_lookup_byaddr(struct net *net, u32 mark, struct xfrm_state *xfrm_state_lookup_exact(struct net *net, const struct xfrm_mark *mark, const xfrm_address_t *daddr, __be32 spi, u8 proto, unsigned short family); +bool xfrm_state_mark_collides(struct net *net, u32 mark, + const xfrm_address_t *daddr, __be32 spi, + u8 proto, unsigned short family, + const struct xfrm_state *self); #ifdef CONFIG_XFRM_SUB_POLICY void xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n, unsigned short family); diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c index f1e04df8d501..65663c7ba836 100644 --- a/net/xfrm/xfrm_state.c +++ b/net/xfrm/xfrm_state.c @@ -2202,10 +2202,12 @@ int xfrm_state_migrate_install(const struct xfrm_state *x, struct netlink_ext_ack *extack) { if (m->new_family == m->old_family && - xfrm_addr_equal(&x->id.daddr, &m->new_daddr, m->new_family)) { + xfrm_addr_equal(&x->id.daddr, &m->new_daddr, m->new_family) && + xc->mark.v == x->mark.v && xc->mark.m == x->mark.m) { /* - * Care is needed when the destination address of the state is - * to be updated as it is a part of triplet. + * Care is needed when the destination address or mark of the + * state is to be updated, as they are part of the lookup + * triplet. */ xfrm_state_insert(xc); } else { @@ -2440,6 +2442,38 @@ xfrm_state_lookup_exact(struct net *net, const struct xfrm_mark *mark, } EXPORT_SYMBOL(xfrm_state_lookup_exact); +/* True if some OTHER state at this tuple would wildcard-match "mark". + * Used by MIGRATE_STATE, which must exclude the state being migrated. + */ +bool xfrm_state_mark_collides(struct net *net, u32 mark, + const xfrm_address_t *daddr, __be32 spi, + u8 proto, unsigned short family, + const struct xfrm_state *self) +{ + struct xfrm_hash_state_ptrs state_ptrs; + unsigned int h; + struct xfrm_state *x; + bool collides = false; + + rcu_read_lock(); + xfrm_hash_ptrs_get(net, &state_ptrs); + h = __xfrm_spi_hash(daddr, spi, proto, family, state_ptrs.hmask); + + hlist_for_each_entry_rcu(x, state_ptrs.byspi + h, byspi) { + if (x != self && x->props.family == family && + x->id.spi == spi && x->id.proto == proto && + xfrm_addr_equal(&x->id.daddr, daddr, family) && + (mark & x->mark.m) == x->mark.v) { + collides = true; + break; + } + } + rcu_read_unlock(); + + return collides; +} +EXPORT_SYMBOL(xfrm_state_mark_collides); + struct xfrm_state * xfrm_find_acq(struct net *net, const struct xfrm_mark *mark, u8 mode, u32 reqid, u32 if_id, u32 pcpu_num, u8 proto, const xfrm_address_t *daddr, diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c index 4de8c401eb44..a5fbe38839c4 100644 --- a/net/xfrm/xfrm_user.c +++ b/net/xfrm/xfrm_user.c @@ -3476,15 +3476,14 @@ static int xfrm_do_migrate_state(struct sk_buff *skb, struct nlmsghdr *nlh, x->nat_keepalive_interval); if (m.new_family != um->id.family || - !xfrm_addr_equal(&m.new_daddr, &um->id.daddr, um->id.family)) { - u32 new_mark_key = m.new_mark ? m.new_mark->v & m.new_mark->m : - m.old_mark.v & m.old_mark.m; - struct xfrm_state *x_new; + !xfrm_addr_equal(&m.new_daddr, &um->id.daddr, um->id.family) || + (m.new_mark && (m.new_mark->v != x->mark.v || + m.new_mark->m != x->mark.m))) { + const struct xfrm_mark *new_mark = m.new_mark ? m.new_mark : &x->mark; - x_new = xfrm_state_lookup(net, new_mark_key, &m.new_daddr, - um->id.spi, um->id.proto, m.new_family); - if (x_new) { - xfrm_state_put(x_new); + if (xfrm_state_mark_collides(net, new_mark->v & new_mark->m, + &m.new_daddr, um->id.spi, + um->id.proto, m.new_family, x)) { NL_SET_ERR_MSG(extack, "New SA tuple already occupied"); err = -EEXIST; goto out; From 24bc5e549913c37fa30693fd3a62a16757c14327 Mon Sep 17 00:00:00 2001 From: Antony Antony Date: Wed, 7 Oct 2026 11:35:58 +0200 Subject: [PATCH 8/9] xfrm: pass extack through to xfrm_init_replay() from xfrm_init_state() xfrm_init_state() takes an extack parameter but doesn't pass it to xfrm_init_replay(), so replay-window errors can't be reported via extack. Fixes: 231a1744dc43 ("xfrm: add extack to xfrm_init_state") Signed-off-by: Antony Antony Signed-off-by: Steffen Klassert --- net/xfrm/xfrm_state.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c index 65663c7ba836..0555e5d796ed 100644 --- a/net/xfrm/xfrm_state.c +++ b/net/xfrm/xfrm_state.c @@ -3384,7 +3384,7 @@ int xfrm_init_state(struct xfrm_state *x, struct netlink_ext_ack *extack) if (err) return err; - err = xfrm_init_replay(x, NULL); + err = xfrm_init_replay(x, extack); if (err) return err; From dcf413245c8c2351f7f80502f89c344256f61a66 Mon Sep 17 00:00:00 2001 From: Antony Antony Date: Wed, 7 Oct 2026 11:36:08 +0200 Subject: [PATCH 9/9] docs: xfrm: include mark in XFRM_MSG_MIGRATE_STATE EEXIST tuple Document mark as part of the EEXIST tuple and update the SA lookup description to match. Fixes: c13c0cc6f52e ("xfrm: add documentation for XFRM_MSG_MIGRATE_STATE") Signed-off-by: Antony Antony Signed-off-by: Steffen Klassert --- .../networking/xfrm/xfrm_migrate_state.rst | 25 +++++++++++++------ 1 file changed, 17 insertions(+), 8 deletions(-) diff --git a/Documentation/networking/xfrm/xfrm_migrate_state.rst b/Documentation/networking/xfrm/xfrm_migrate_state.rst index 9d53cb22b007..ca2c9e5aaf33 100644 --- a/Documentation/networking/xfrm/xfrm_migrate_state.rst +++ b/Documentation/networking/xfrm/xfrm_migrate_state.rst @@ -27,15 +27,20 @@ SA Identification ================= The struct is defined in ``include/uapi/linux/xfrm.h``. The SA is looked -up using ``xfrm_state_lookup()`` with ``id.spi``, -``id.daddr``, ``id.proto``, ``id.family``, and -``old_mark.v & old_mark.m`` as the mark key:: +up using ``xfrm_state_lookup_exact()`` with ``id.spi``, ``id.daddr``, +``id.proto``, ``id.family``, and an exact match against ``old_mark.v`` +and ``old_mark.m``. Unlike the data path, which uses a masked +comparison, this requires the SA's mark and mask to equal ``old_mark`` +exactly, so a broad-mask SA is never matched when a more specific one +was intended. If no such SA exists, ``-ESRCH`` is returned. + +The layout is:: struct xfrm_user_migrate_state { struct xfrm_usersa_id id; /* spi, daddr, proto, family */ xfrm_address_t new_daddr; xfrm_address_t new_saddr; - struct xfrm_mark old_mark; /* SA lookup: key = v & m */ + struct xfrm_mark old_mark; /* SA lookup key (exact v/m match) */ struct xfrm_selector new_sel; /* new selector (see Flags) */ __u32 new_reqid; __u32 flags; /* XFRM_MIGRATE_STATE_* */ @@ -72,8 +77,8 @@ inherits the value from the existing SA (omit-to-inherit). - Description * - ``XFRMA_MARK`` - Mark on the migrated SA (``struct xfrm_mark``). Absent inherits - ``old_mark``. To use no mark on the new SA, send ``XFRMA_MARK`` - with ``{0, 0}``. + the mark of the existing SA. To use no mark on the new SA, send + ``XFRMA_MARK`` with ``{0, 0}``. * - ``XFRMA_ENCAP`` - UDP encapsulation template; only ``UDP_ENCAP_ESPINUDP`` is supported. Set ``encap_type=0`` to remove encap. @@ -259,8 +264,12 @@ Attributes in the notification Error Handling ============== -If the target SA tuple (new daddr, SPI, proto, new family) is already -occupied, the operation returns ``-EEXIST`` before the migration begins. +If the target SA tuple (new daddr, SPI, proto, new family, mark) is +already occupied, the operation returns ``-EEXIST`` before the migration +begins. "Occupied" includes wildcard shadowing: an existing SA with a +broader mask (e.g. mark 0/0) claims every mark value, so it blocks +migrating to any more specific mark at the same tuple, not just an +exact mark/mask duplicate. The old SA remains intact and the operation is safe to retry after resolving the conflict.