Re: [PATCH 1/7] net, smack: Create a function to set secmarks

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] The helper `secxa_set_secmark` causes build failures under two valid kernel configurations: when `CONFIG_SECURITY=y` with `CONFIG_NETWORK_SECMARK=n` (invalid struct member access), and when `CONFIG_SECURITY=n` with `CONFIG_NETWORK_SECMARK=y` (implicit function declaration).
--

--- Patch [1]: [PATCH 1/7] net, smack: Create a function to set secmarks ---
commit e74441b7e906ce8624528752b177a2d903d76f44
Author: Casey Schaufler <casey@schaufler-ca.com>

net, smack: Create a function to set secmarks

This patch creates a helper function secxa_set_secmark() to assign a secmark
to an skb, replacing direct assignments to skb->secmark. This allows for
cases where assigning a secmark is more complex.

> diff --git a/include/linux/lsm_secxa.h b/include/linux/lsm_secxa.h
> new file mode 100644
> index 0000000000000..f4c732d26680c
> --- /dev/null
> +++ b/include/linux/lsm_secxa.h
> @@ -0,0 +1,22 @@
> +/* SPDX-License-Identifier: GPL-2.0 */
> +
> +/*
> + * Copyright (C) 2026 Casey Schaufler <casey@schaufler-ca.com>
> + */
> +
> +#ifndef __LINUX_LSM_SECXA_H
> +#define __LINUX_LSM_SECXA_H
> +
> +#ifdef CONFIG_SECURITY
> +
> +#include <linux/security.h>
> +#include <linux/skbuff.h>
> +
> +static inline void secxa_set_secmark(struct sk_buff *skb, u32 secxa)
> +{
> +	skb->secmark = secxa;

[Severity: Low]
Could this cause build failures under certain configurations?

If CONFIG_SECURITY is enabled but CONFIG_NETWORK_SECMARK is disabled,
skb->secmark won't exist in struct sk_buff, which would result in an invalid
member access error here.

Additionally, if CONFIG_SECURITY is disabled but CONFIG_NETWORK_SECMARK is
enabled, this function won't be declared. This would cause implicit function
declaration errors in modules like xt_CONNSECMARK.c that call it.

Should this helper be guarded by CONFIG_NETWORK_SECMARK instead of
CONFIG_SECURITY, or perhaps both?

> +}
> +
> +#endif /* CONFIG_SECURITY */
> +
> +#endif  /* __LINUX_LSM_SECXA_H */

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260813204854.19211-1-casey@schaufler-ca.com?part=1