While looking into a XFRM_MSG_MIGRATE_STATE issue reported by Sashiko,
we found the underlying problem generalizes: xfrm allows multiple SAs
to coexist for the same (SPI, daddr, proto) differing only in mark,
and every netlink method that resolves "which SA" - xfrm get_sa(),
del_sa(), update, get_ae, new_ae, expire, migrate - uses the same
wildcard mark match the data path needs. A broader-mask SA can
silently shadow a more specific one:
# ip xfrm state add ... spi 0x1000 mark 1 mask 1 (SA_target)
# ip xfrm state add ... spi 0x1000 mark 0 mask 0
(SA_decoy, catch-all, added after -> bucket head)
# ip xfrm state delete dst ... proto esp spi 0x1000 mark 1 mask 1
-> deletes SA_decoy; SA_target survives, untouched
xfrm policy had the same bug, fixed in commit 4f47e8ab6ab7
("xfrm: policy: match with both mark and mask on user interfaces").
Netlink lookups use an exact mark/mask match except for UPDSA; the
wildcard match stays for the data path and state_add only.
This series applies that fix across every affected method,
not just XFRM_MSG_MIGRATE_STATE.
This series is not fixing likely isusses PF_KEY. As it
is no more receiving non critical fixes.
---
v1->v2: few more wildcard mark check reported by sashiko and Yan
- keep wildcard match in xfrm_state_update() (UPDSA)
- Link to v1:
https://patch.msgid.link/[email protected]
---
Antony Antony (6):
xfrm: state: exact mark/mask match for SPI-keyed control-plane SA lookups
xfrm: fix use-after-free of migrated state in xfrm_do_migrate_state()
xfrm: fix hw offload state leak on xfrm_do_migrate_state() error path
xfrm: include mark in MIGRATE_STATE SA collision check
xfrm: pass extack through to xfrm_init_replay() from xfrm_init_state()
docs: xfrm: include mark in XFRM_MSG_MIGRATE_STATE EEXIST tuple
.../networking/xfrm/xfrm_migrate_state.rst | 23 +++--
include/net/xfrm.h | 7 ++
net/xfrm/xfrm_state.c | 98 ++++++++++++++++++----
net/xfrm/xfrm_user.c | 51 ++++++-----
4 files changed, 134 insertions(+), 45 deletions(-)
---
base-commit: 96f01b53c2d05e003b040892256de54a586e8529
change-id: migrate-state-fixes-063ee0342611
--
Antony
