Commit 51a209ee authored by Paolo Abeni's avatar Paolo Abeni
Browse files

Merge tag 'ipsec-2026-03-23' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec 

Steffen Klassert says:

====================
pull request (net): ipsec 2026-03-23

1) Add missing extack for XFRMA_SA_PCPU in add_acquire and allocspi.
   From Sabrina Dubroca.

2) Fix the condition on x->pcpu_num in xfrm_sa_len by using the
   proper check. From Sabrina Dubroca.

3) Call xdo_dev_state_delete during state update to properly cleanup
   the xdo device state. From Sabrina Dubroca.

4) Fix a potential skb leak in espintcp when async crypto is used.
   From Sabrina Dubroca.

5) Validate inner IPv4 header length in IPTFS payload to avoid
   parsing malformed packets. From Roshan Kumar.

6) Fix skb_put() panic on non-linear skb during IPTFS reassembly.
   From Fernando Fernandez Mancera.

7) Silence various sparse warnings related to RCU, state, and policy
   handling. From Sabrina Dubroca.

8) Fix work re-schedule race after cancel in xfrm_nat_keepalive_net_fini().
   From Hyunwoo Kim.

9) Prevent policy_hthresh.work from racing with netns teardown by using
   a proper cleanup mechanism. From Minwoo Ra.

10) Validate that the family of the source and destination addresses match
    in pfkey_send_migrate(). From Eric Dumazet.

11) Only publish mode_data after the clone is setup in the IPTFS receive path.
    This prevents leaving x->mode_data pointing at freed memory on error.
    From Paul Moses.

Please pull or let me know if there are problems.

ipsec-2026-03-23

* tag 'ipsec-2026-03-23' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec:
  xfrm: iptfs: only publish mode_data after clone setup
  af_key: validate families in pfkey_send_migrate()
  xfrm: prevent policy_hthresh.work from racing with netns teardown
  xfrm: Fix work re-schedule after cancel in xfrm_nat_keepalive_net_fini()
  xfrm: avoid RCU warnings around the per-netns netlink socket
  xfrm: add rcu_access_pointer to silence sparse warning for xfrm_input_afinfo
  xfrm: policy: silence sparse warning in xfrm_policy_unregister_afinfo
  xfrm: policy: fix sparse warnings in xfrm_policy_{init,fini}
  xfrm: state: silence sparse warnings during netns exit
  xfrm: remove rcu/state_hold from xfrm_state_lookup_spi_proto
  xfrm: state: add xfrm_state_deref_prot to state_by* walk under lock
  xfrm: state: fix sparse warnings around XFRM_STATE_INSERT
  xfrm: state: fix sparse warnings in xfrm_state_init
  xfrm: state: fix sparse warnings on xfrm_state_hold_rcu
  xfrm: iptfs: fix skb_put() panic on non-linear skb during reassembly
  xfrm: iptfs: validate inner IPv4 header length in IPTFS payload
  esp: fix skb leak with espintcp and async crypto
  xfrm: call xdo_dev_state_delete during state update
  xfrm: fix the condition on x->pcpu_num in xfrm_sa_len
  xfrm: add missing extack for XFRMA_SA_PCPU in add_acquire and allocspi
====================

Link: https://patch.msgid.link/20260323083440.2741292-1-steffen.klassert@secunet.com


Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
parents 647b8a2f d849a2f7

include/net/netns/xfrm.h

+1 −1
Original line number Diff line number Diff line
@@ -59,7 +59,7 @@ struct netns_xfrm { 
	struct list_head	inexact_bins;





	struct sock		*nlsk;

	struct sock		__rcu *nlsk;

	struct sock		*nlsk_stash;



	u32			sysctl_aevent_etime;

net/ipv4/esp4.c

+6 −3
Original line number Diff line number Diff line
@@ -235,12 +235,15 @@ static void esp_output_done(void *data, int err) 
		xfrm_dev_resume(skb);

	} else {

		if (!err &&

		    x->encap && x->encap->encap_type == TCP_ENCAP_ESPINTCP)

			esp_output_tail_tcp(x, skb);

		else

		    x->encap && x->encap->encap_type == TCP_ENCAP_ESPINTCP) {

			err = esp_output_tail_tcp(x, skb);

			if (err != -EINPROGRESS)

				kfree_skb(skb);

		} else {

			xfrm_output_resume(skb_to_full_sk(skb), skb, err);

		}

	}

}



/* Move ESP header back into place. */

static void esp_restore_header(struct sk_buff *skb, unsigned int offset)

net/ipv6/esp6.c

+6 −3
Original line number Diff line number Diff line
@@ -271,12 +271,15 @@ static void esp_output_done(void *data, int err) 
		xfrm_dev_resume(skb);

	} else {

		if (!err &&

		    x->encap && x->encap->encap_type == TCP_ENCAP_ESPINTCP)

			esp_output_tail_tcp(x, skb);

		else

		    x->encap && x->encap->encap_type == TCP_ENCAP_ESPINTCP) {

			err = esp_output_tail_tcp(x, skb);

			if (err != -EINPROGRESS)

				kfree_skb(skb);

		} else {

			xfrm_output_resume(skb_to_full_sk(skb), skb, err);

		}

	}

}



/* Move ESP header back into place. */

static void esp_restore_header(struct sk_buff *skb, unsigned int offset)

net/key/af_key.c

+12 −7
Original line number Diff line number Diff line
@@ -3518,7 +3518,7 @@ static int set_sadb_kmaddress(struct sk_buff *skb, const struct xfrm_kmaddress * 


static int set_ipsecrequest(struct sk_buff *skb,

			    uint8_t proto, uint8_t mode, int level,

			    uint32_t reqid, uint8_t family,

			    uint32_t reqid, sa_family_t family,

			    const xfrm_address_t *src, const xfrm_address_t *dst)

{

	struct sadb_x_ipsecrequest *rq;
@@ -3583,12 +3583,17 @@ static int pfkey_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type, 


	/* ipsecrequests */

	for (i = 0, mp = m; i < num_bundles; i++, mp++) {

		/* old locator pair */

		size_pol += sizeof(struct sadb_x_ipsecrequest) +

			    pfkey_sockaddr_pair_size(mp->old_family);

		/* new locator pair */

		size_pol += sizeof(struct sadb_x_ipsecrequest) +

			    pfkey_sockaddr_pair_size(mp->new_family);

		int pair_size;



		pair_size = pfkey_sockaddr_pair_size(mp->old_family);

		if (!pair_size)

			return -EINVAL;

		size_pol += sizeof(struct sadb_x_ipsecrequest) + pair_size;



		pair_size = pfkey_sockaddr_pair_size(mp->new_family);

		if (!pair_size)

			return -EINVAL;

		size_pol += sizeof(struct sadb_x_ipsecrequest) + pair_size;

	}



	size += sizeof(struct sadb_msg) + size_pol;

net/xfrm/xfrm_input.c

+4 −1
Original line number Diff line number Diff line
@@ -75,7 +75,10 @@ int xfrm_input_unregister_afinfo(const struct xfrm_input_afinfo *afinfo) 


	spin_lock_bh(&xfrm_input_afinfo_lock);

	if (likely(xfrm_input_afinfo[afinfo->is_ipip][afinfo->family])) {

		if (unlikely(xfrm_input_afinfo[afinfo->is_ipip][afinfo->family] != afinfo))

		const struct xfrm_input_afinfo *cur;



		cur = rcu_access_pointer(xfrm_input_afinfo[afinfo->is_ipip][afinfo->family]);

		if (unlikely(cur != afinfo))

			err = -EINVAL;

		else

			RCU_INIT_POINTER(xfrm_input_afinfo[afinfo->is_ipip][afinfo->family], NULL);