[PATCH v2] xfrm: account XFRMA_IF_ID and XFRMA_OFFLOAD_DEV in acquire/polexpire/expire size calculations

[PATCH v2] xfrm: account XFRMA_IF_ID and XFRMA_OFFLOAD_DEV in acquire/polexpire/expire size calculations

[Adrian Martinez Garcia]

From 534cb2b5fb8da81677f2955aac8a98d9aa89694b Mon Sep 17 00:00:00 2001
From: Adrian Martinez <adrimg3196@gmail.com>
Date: Sun, 11 Oct 2026 06:53:31 +0000
Subject: [PATCH] xfrm: account XFRMA_IF_ID and XFRMA_OFFLOAD_DEV in
 acquire/polexpire/expire size calculations

xfrm_send_acquire() and xfrm_exp_policy_notify() allocate their reply skb
with xfrm_acquire_msgsize() and xfrm_polexpire_msgsize(), then build_acquire()
and build_polexpire() append attributes including XFRMA_IF_ID (when the
policy if_id is set) and XFRMA_OFFLOAD_DEV (when the policy is bound to an
xfrm offload device).  Neither size helper reserves space for these two
conditionally emitted attributes, so for policies carrying if_id, mark,
pcpu and/or an offload device the builders can run out of skb tailroom,
fail with -EMSGSIZE and hit BUG_ON(err < 0), turning a netlink event into
a kernel panic.

build_expire() has the same XFRMA_IF_ID undercount in xfrm_expire_msgsize();
its caller already handles -EMSGSIZE gracefully, so the only effect there
is a dropped EXPIRE notification.

This is the same bug class as CVE-2026-43107, whose fix (7081d46d32)
only covered the aevent pair.

Account XFRMA_IF_ID and XFRMA_OFFLOAD_DEV in the three size calculations
unconditionally, and replace the two BUG_ONs with normal error unwinding,
mirroring the aevent fix.

Fixes: 7e6526404ade ("xfrm: Add a new lookup key to match xfrm interfaces.")
Signed-off-by: Adrian Martinez <adrimg3196@gmail.com>
---
 net/xfrm/xfrm_user.c | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index a2587c7e..5eb79b0b 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -3927,7 +3927,8 @@ static inline unsigned int xfrm_expire_msgsize(void)
 	return NLMSG_ALIGN(sizeof(struct xfrm_user_expire)) +
 	       nla_total_size(sizeof(struct xfrm_mark)) +
 	       nla_total_size(sizeof_field(struct xfrm_state, dir)) +
-	       nla_total_size(4); /* XFRMA_SA_PCPU */
+	       nla_total_size(4) + /* XFRMA_SA_PCPU */
+	       nla_total_size(4); /* XFRMA_IF_ID */
 }

 static int build_expire(struct sk_buff *skb, struct xfrm_state *x,
const struct km_event *c)
@@ -4177,6 +4178,8 @@ static inline unsigned int
xfrm_acquire_msgsize(struct xfrm_state *x,
 	       + nla_total_size(sizeof(struct xfrm_mark))
 	       + nla_total_size(xfrm_user_sec_ctx_size(x->security))
 	       + nla_total_size(4) /* XFRMA_SA_PCPU */
+	       + nla_total_size(sizeof(xp->if_id)) /* XFRMA_IF_ID */
+	       + nla_total_size(sizeof(struct xfrm_user_offload)) /*
XFRMA_OFFLOAD_DEV */
 	       + userpolicy_type_attrsize();
 }

@@ -4236,7 +4239,10 @@ static int xfrm_send_acquire(struct xfrm_state
*x, struct xfrm_tmpl *xt,
 		return -ENOMEM;

 	err = build_acquire(skb, x, xt, xp);
-	BUG_ON(err < 0);
+	if (err < 0) {
+		kfree_skb(skb);
+		return err;
+	}

 	return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_ACQUIRE);
 }
@@ -4307,6 +4313,8 @@ static inline unsigned int
xfrm_polexpire_msgsize(struct xfrm_policy *xp)
 	       + nla_total_size(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr)
 	       + nla_total_size(xfrm_user_sec_ctx_size(xp->security))
 	       + nla_total_size(sizeof(struct xfrm_mark))
+	       + nla_total_size(sizeof(xp->if_id)) /* XFRMA_IF_ID */
+	       + nla_total_size(sizeof(struct xfrm_user_offload)) /*
XFRMA_OFFLOAD_DEV */
 	       + userpolicy_type_attrsize();
 }

@@ -4358,7 +4366,10 @@ static int xfrm_exp_policy_notify(struct
xfrm_policy *xp, int dir, const struct
 		return -ENOMEM;

 	err = build_polexpire(skb, xp, dir, c);
-	BUG_ON(err < 0);
+	if (err < 0) {
+		kfree_skb(skb);
+		return err;
+	}

 	return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_EXPIRE);
 }
-- 
2.43.0

Re: [PATCH v2] xfrm: account XFRMA_IF_ID and XFRMA_OFFLOAD_DEV in acquire/polexpire/expire size calculations

[netdev-bot+sinfo]

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - How the issue was discovered, e.g. hit in production, hit during
   development, syzbot report, manual code inspection, LLM or static
   analysis tool scan.

 - Whether the issue was actually triggered, or is only theoretical
   (e.g. found by code inspection). If it was triggered please include
   the symptoms, like the stack trace or error messages.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.

Re: [PATCH v2] xfrm: account XFRMA_IF_ID and XFRMA_OFFLOAD_DEV in acquire/polexpire/expire size calculations

[Nicolas Dichtel]

Le 12/10/2026 à 16:39, Adrian Martinez Garcia a écrit :
> From 534cb2b5fb8da81677f2955aac8a98d9aa89694b Mon Sep 17 00:00:00 2001
> From: Adrian Martinez <adrimg3196@gmail.com>
> Date: Sun, 11 Oct 2026 06:53:31 +0000
> Subject: [PATCH] xfrm: account XFRMA_IF_ID and XFRMA_OFFLOAD_DEV in
>  acquire/polexpire/expire size calculations
> 
> xfrm_send_acquire() and xfrm_exp_policy_notify() allocate their reply skb
> with xfrm_acquire_msgsize() and xfrm_polexpire_msgsize(), then build_acquire()
> and build_polexpire() append attributes including XFRMA_IF_ID (when the
> policy if_id is set) and XFRMA_OFFLOAD_DEV (when the policy is bound to an
> xfrm offload device).  Neither size helper reserves space for these two
> conditionally emitted attributes, so for policies carrying if_id, mark,
> pcpu and/or an offload device the builders can run out of skb tailroom,
> fail with -EMSGSIZE and hit BUG_ON(err < 0), turning a netlink event into
> a kernel panic.
> 
> build_expire() has the same XFRMA_IF_ID undercount in xfrm_expire_msgsize();
> its caller already handles -EMSGSIZE gracefully, so the only effect there
> is a dropped EXPIRE notification.
> 
> This is the same bug class as CVE-2026-43107, whose fix (7081d46d32)
> only covered the aevent pair.
> 
> Account XFRMA_IF_ID and XFRMA_OFFLOAD_DEV in the three size calculations
> unconditionally, and replace the two BUG_ONs with normal error unwinding,
> mirroring the aevent fix.
> 
> Fixes: 7e6526404ade ("xfrm: Add a new lookup key to match xfrm interfaces.")
> Signed-off-by: Adrian Martinez <adrimg3196@gmail.com>
Please, keep in CC people who have made comments (me in this case ;-)).

> ---
>  net/xfrm/xfrm_user.c | 17 ++++++++++++++---
>  1 file changed, 14 insertions(+), 3 deletions(-)
> 
> diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
> index a2587c7e..5eb79b0b 100644
> --- a/net/xfrm/xfrm_user.c
> +++ b/net/xfrm/xfrm_user.c
> @@ -3927,7 +3927,8 @@ static inline unsigned int xfrm_expire_msgsize(void)
>  	return NLMSG_ALIGN(sizeof(struct xfrm_user_expire)) +
>  	       nla_total_size(sizeof(struct xfrm_mark)) +
>  	       nla_total_size(sizeof_field(struct xfrm_state, dir)) +
> -	       nla_total_size(4); /* XFRMA_SA_PCPU */
> +	       nla_total_size(4) + /* XFRMA_SA_PCPU */
> +	       nla_total_size(4); /* XFRMA_IF_ID */
>  }
> 
>  static int build_expire(struct sk_buff *skb, struct xfrm_state *x,
> const struct km_event *c)
> @@ -4177,6 +4178,8 @@ static inline unsigned int
> xfrm_acquire_msgsize(struct xfrm_state *x,
>  	       + nla_total_size(sizeof(struct xfrm_mark))
>  	       + nla_total_size(xfrm_user_sec_ctx_size(x->security))
>  	       + nla_total_size(4) /* XFRMA_SA_PCPU */
> +	       + nla_total_size(sizeof(xp->if_id)) /* XFRMA_IF_ID */
> +	       + nla_total_size(sizeof(struct xfrm_user_offload)) /*
> XFRMA_OFFLOAD_DEV */
>  	       + userpolicy_type_attrsize();
>  }
> 
> @@ -4236,7 +4239,10 @@ static int xfrm_send_acquire(struct xfrm_state
> *x, struct xfrm_tmpl *xt,
>  		return -ENOMEM;
> 
>  	err = build_acquire(skb, x, xt, xp);
> -	BUG_ON(err < 0);
> +	if (err < 0) {
> +		kfree_skb(skb);
> +		return err;
> +	}
Silently dropping a netlink message is not an option. As this fix shows, if this
happens, the kernel is buggy.
WARN_ON_ONCE() maybe, but it should be done in a separate patch.

> 
>  	return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_ACQUIRE);
>  }
> @@ -4307,6 +4313,8 @@ static inline unsigned int
> xfrm_polexpire_msgsize(struct xfrm_policy *xp)
>  	       + nla_total_size(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr)
>  	       + nla_total_size(xfrm_user_sec_ctx_size(xp->security))
>  	       + nla_total_size(sizeof(struct xfrm_mark))
> +	       + nla_total_size(sizeof(xp->if_id)) /* XFRMA_IF_ID */
> +	       + nla_total_size(sizeof(struct xfrm_user_offload)) /*
> XFRMA_OFFLOAD_DEV */
>  	       + userpolicy_type_attrsize();
>  }
> 
> @@ -4358,7 +4366,10 @@ static int xfrm_exp_policy_notify(struct
> xfrm_policy *xp, int dir, const struct
>  		return -ENOMEM;
> 
>  	err = build_polexpire(skb, xp, dir, c);
> -	BUG_ON(err < 0);
> +	if (err < 0) {
> +		kfree_skb(skb);
> +		return err;
> +	}
> 
>  	return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_EXPIRE);
>  }