From b3056e57b0657a4401349187c620d0fa1b8914c8 Mon Sep 17 00:00:00 2001 From: Antony Antony Date: Wed, 7 Oct 2026 11:35:00 +0200 Subject: [PATCH] xfrm: policy: reject mark with bits outside its mask on add Same issue as states: an invalid mark/mask is silently truncated on insert, so GETPOLICY and DELPOLICY can no longer find the policy by id. Reject it instead. The mark is no longer sanitized on policy insert. Fixes: 0b91fda3a1f0 ("xfrm: Sanitize marks before insert") Cc: # avoid breaking existing userspace ABI Signed-off-by: Antony Antony Signed-off-by: Steffen Klassert --- net/xfrm/xfrm_policy.c | 3 --- net/xfrm/xfrm_user.c | 3 +++ 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c index f6f40ba713d5..0f6fcea28bcd 100644 --- a/net/xfrm/xfrm_policy.c +++ b/net/xfrm/xfrm_policy.c @@ -1575,9 +1575,6 @@ int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl) struct xfrm_policy *delpol; struct hlist_head *chain; - /* Sanitize mark before store */ - policy->mark.v &= policy->mark.m; - spin_lock_bh(&net->xfrm.xfrm_policy_lock); chain = policy_hash_bysel(net, &policy->selector, policy->family, dir); if (chain) diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c index 6b53373168b0..c1571c7a2315 100644 --- a/net/xfrm/xfrm_user.c +++ b/net/xfrm/xfrm_user.c @@ -2307,6 +2307,9 @@ static int xfrm_add_policy(struct sk_buff *skb, struct nlmsghdr *nlh, if (err) return err; err = verify_sec_ctx_len(attrs, extack); + if (err) + return err; + err = verify_mark(attrs, extack); if (err) return err;