Re: [PATCH net] macsec: reject frames after receive PN exhaustion

[Sabrina Dubroca <sd@queasysnail.net>]

2026-10-09, 22:51:08 +0900, Sung Byeongchan wrote:
> Track the exhausted state explicitly.  Preserve the full recovered XPN in
> the skb control block so that the post-authentication path can identify the
> full-width terminal value.  Deliver the valid terminal frame once, mark the
> RXSA exhausted under its lock, and reject later frames.  Clear the state
> when the receive SA is initialized or its PN is explicitly reset, and
> restore it if an offload update fails.
> 
> The unmodified kernel accepted a post-terminal authenticated frame in three
> fresh boots for both non-XPN and XPN.  With this change, the terminal frame
> was delivered once and every post-terminal frame was dropped in three fresh
> boots.  Lower-word XPN wrap, replay-window, bad-ICV, reset, replacement,
> and concurrent-duplicate controls continued to pass.

Even after understanding the actual code, I can barely follow those 2
paragraphs. Please make your LLM write in a less obfuscated style (and
also not describe the patch line-by-line).


> @@ -744,6 +745,15 @@ static bool macsec_post_decrypt(struct sk_buff *skb, struct macsec_secy *secy, u
>  	u32 lowest_pn = 0;
>  
>  	spin_lock(&rx_sa->lock);
> +	if (rx_sa->exhausted) {

That's not reasonable. Now we will reject "delayed" packets that would
fall in the replay window.



nit: the style in this patch is also not nice:

> +		spin_unlock(&rx_sa->lock);
> +		u64_stats_update_begin(&rxsc_stats->syncp);
> +		rxsc_stats->stats.InPktsLate++;
> +		u64_stats_update_end(&rxsc_stats->syncp);
> +		DEV_STATS_INC(secy->netdev, rx_dropped);
> +		return false;

duplication of this big stats block


> +		if ((!secy->xpn && pn == U32_MAX) ||
> +		    (secy->xpn && macsec_skb_cb(skb)->xpn_pn.full64 == U64_MAX)) {

bool exhausted = secy->xpn ? pn64 == U64_MAX : pn32 == U32_MAX;

-- 
pw-bot: cr