[PATCH 0/7] pull request (net): ipsec 2026-06-22

[Steffen Klassert <steffen.klassert@secunet.com>]

1) xfrm: use compat translator only for u64 alignment mismatch
   Gate the XFRM_USER_COMPAT translator on COMPAT_FOR_U64_ALIGNMENT
   so 32-bit compat tasks on arches whose 32-bit ABI already matches
   the native 64-bit layout are no longer rejected with -EOPNOTSUPP.
   From Sanman Pradhan.

2) net: af_key: initialize alg_key_len for IPComp states
   Initialize the alg_key_len to 0 in the IPComp branch of
   pfkey_msg2xfrm_state() so an uninitialized value cannot drive
   xfrm_alg_len() into a slab-out-of-bounds kmemdup during
   XFRM_MSG_MIGRATE. From Zijing Yin.

3) xfrm: Fix dev use-after-free in xfrm async resumption
   Stash the original skb->dev and extend the RCU critical section
   across xfrm_rcv_cb() and transport_finish() to prevent a
   tunnel-device UAF and original-device refcount leak when a
   callback replaces skb->dev. From Dong Chenchen.

4) xfrm: Fix xfrm state cache insertion race
   Move the state-validity check inside xfrm_state_lock in the
   input state cache insertion path so a state cannot be killed
   between the check and the insert. From Herbert Xu.

5) xfrm: annotate data-races around xfrm_policy_count[] and xfrm_policy_default[]
   Add READ_ONCE()/WRITE_ONCE() annotations on xfrm_policy_count
   and xfrm_policy_default to silence the KCSAN data race reported
   on net->xfrm.policy_count. From Eric Dumazet.

6) espintcp: use sk_msg_free_partial to fix partial send
   Replace the manual skmsg accounting in espintcp with
   sk_msg_free_partial() so the skmsg stays consistent on every
   iteration and the partial-send accounting bugs go away.
   From Sabrina Dubroca.

7) xfrm: validate selector family and prefixlen during match
   Reject mismatched address families in xfrm_selector_match() and
   bound prefixlen in addr4_match()/addr_match() to prevent the
   shift-out-of-bounds syzbot reported when an AF_UNSPEC selector
   with a large prefixlen is matched against an IPv4 flow.
   From Eric Dumazet.

Please pull or let me know if there are problems.

Thanks!

The following changes since commit 9bf10032894f429b3e221de63cf95a8544511a90:

  Merge branch 'tipc-fix-netlink-gate-and-receive-path-bugs' (2026-06-11 16:01:19 -0700)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec.git tags/ipsec-2026-06-22

for you to fetch changes up to 40f0b1047918539f0b0f795ac65e35336b4c2c78:

  xfrm: validate selector family and prefixlen during match (2026-06-17 11:17:27 +0200)

----------------------------------------------------------------
ipsec-2026-06-22

----------------------------------------------------------------
Dong Chenchen (1):
      xfrm: Fix dev use-after-free in xfrm async resumption

Eric Dumazet (2):
      xfrm: annotate data-races around xfrm_policy_count[] and xfrm_policy_default[]
      xfrm: validate selector family and prefixlen during match

Herbert Xu (1):
      xfrm: Fix xfrm state cache insertion race

Sabrina Dubroca (1):
      espintcp: use sk_msg_free_partial to fix partial send

Sanman Pradhan (1):
      xfrm: use compat translator only for u64 alignment mismatch

Zijing Yin (1):
      net: af_key: initialize alg_key_len for IPComp states

 include/net/xfrm.h     | 15 +++++++++++----
 net/ipv4/xfrm4_input.c |  2 --
 net/ipv6/xfrm6_input.c |  2 --
 net/key/af_key.c       |  1 +
 net/xfrm/espintcp.c    | 34 +++++++---------------------------
 net/xfrm/xfrm_input.c  | 29 ++++++++++++++++-------------
 net/xfrm/xfrm_policy.c | 27 +++++++++++++++------------
 net/xfrm/xfrm_state.c  | 23 +++++++++++++++--------
 net/xfrm/xfrm_user.c   | 20 ++++++++++----------
 9 files changed, 75 insertions(+), 78 deletions(-)