From: Antony Antony <antony.antony@secunet.com>
To: Antony Antony <antony.antony@secunet.com>,
Steffen Klassert <steffen.klassert@secunet.com>,
Herbert Xu <herbert@gondor.apana.org.au>,
"David S. Miller" <davem@davemloft.net>,
Eric Dumazet <edumazet@google.com>,
Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>,
Simon Horman <horms@kernel.org>, David Ahern <dsahern@kernel.org>,
Jamal Hadi Salim <hadi@cyberus.ca>, Shuah Khan <shuah@kernel.org>
Cc: Sabrina Dubroca <sd@queasysnail.net>, <netdev@vger.kernel.org>,
Yan Yan <evitayan@google.com>,
Tobias Brunner <tobias@strongswan.org>,
Florian Westphal <fw@strlen.de>, <linux-doc@vger.kernel.org>,
Sashiko <sashiko-bot@kernel.org>
Subject: [PATCH ipsec v5 6/9] xfrm: fix hw offload state leak on xfrm_do_migrate_state() error path
Date: Wed, 7 Oct 2026 11:35:39 +0200 [thread overview]
Message-ID: <migrate-state-fixes-v5-6-d9d3d794553d@secunet.com> (raw)
In-Reply-To: <migrate-state-fixes-v5-0-d9d3d794553d@secunet.com>
In the error path, the cloned state is dropped without removing its
hardware offload, leaking the offloaded SA entry.
Fixes: a9d155ea9b44 ("xfrm: add XFRM_MSG_MIGRATE_STATE for single SA migration")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Signed-off-by: Antony Antony <antony.antony@secunet.com>
---
net/xfrm/xfrm_user.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 8640838dcda0..4de8c401eb44 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -3541,6 +3541,8 @@ static int xfrm_do_migrate_state(struct sk_buff *skb, struct nlmsghdr *nlh,
xfrm_state_put(x);
return err;
out_xc:
+ if (m.xuo)
+ xfrm_dev_state_delete(xc);
xc->km.state = XFRM_STATE_DEAD;
xfrm_state_put(xc);
xfrm_state_put(x);
--
2.47.3
next prev parent reply other threads:[~2026-10-07 9:35 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-07 9:34 [PATCH ipsec v5 0/9] xfrm: state: exact mark/mask match for control-plane SA lookups Antony Antony
2026-10-07 9:34 ` [PATCH ipsec v5 1/9] xfrm: state: reject mark with bits outside its mask on add Antony Antony
2026-10-07 9:34 ` [PATCH ipsec v5 2/9] xfrm: state: reject mark with bits outside its mask on ALLOCSPI Antony Antony
2026-10-07 9:35 ` [PATCH ipsec v5 3/9] xfrm: policy: reject mark with bits outside its mask on add Antony Antony
2026-10-07 9:35 ` [PATCH ipsec v5 4/9] xfrm: state: exact mark/mask match for SPI-keyed control-plane SA lookups Antony Antony
2026-10-07 9:35 ` [PATCH ipsec v5 5/9] xfrm: fix use-after-free of migrated state in xfrm_do_migrate_state() Antony Antony
2026-10-07 9:35 ` Antony Antony [this message]
2026-10-07 9:35 ` [PATCH ipsec v5 7/9] xfrm: include mark in MIGRATE_STATE SA collision check Antony Antony
2026-10-07 9:35 ` [PATCH ipsec v5 8/9] xfrm: pass extack through to xfrm_init_replay() from xfrm_init_state() Antony Antony
2026-10-07 9:36 ` [PATCH ipsec v5 9/9] docs: xfrm: include mark in XFRM_MSG_MIGRATE_STATE EEXIST tuple Antony Antony
2026-10-20 5:44 ` [PATCH ipsec v5 0/9] xfrm: state: exact mark/mask match for control-plane SA lookups Steffen Klassert
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=migrate-state-fixes-v5-6-d9d3d794553d@secunet.com \
--to=antony.antony@secunet.com \
--cc=davem@davemloft.net \
--cc=dsahern@kernel.org \
--cc=edumazet@google.com \
--cc=evitayan@google.com \
--cc=fw@strlen.de \
--cc=hadi@cyberus.ca \
--cc=herbert@gondor.apana.org.au \
--cc=horms@kernel.org \
--cc=kuba@kernel.org \
--cc=linux-doc@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=sashiko-bot@kernel.org \
--cc=sd@queasysnail.net \
--cc=shuah@kernel.org \
--cc=steffen.klassert@secunet.com \
--cc=tobias@strongswan.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.