From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=62.96.220.36 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793606692; b=3cuCql03fAfwaKAx1MmA1bEoA3nokf5h4UsQ4vUdnciMiygY0f+wKsiChFd/XnXM7QnT dniGlZpSpmFAEPQRaw9asRRwJp0X40u/QhFdzhJSmdGIjqvXuqSfQXnEObFYdLEL3s9nl VPGlmZg3hbMqP5hLa5y+/JXw40ojXtutqtArjNEWAcTHbqm0v++/7J3fX9XCQdEJ3Wkoj Wy3JziyXOPsVrzbtNoD1nGShb6riFyAPs/LnnjnTUylKzKHCuHDlNMT+tl5E1HKQfeO/q n7VigVFyEbynoRdHy3B3Q22T+mAsbjEmE/paQ3toB1UyHhc3PVkhVKgsb2S/ggg7luA== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793606692; h=DMARC-Filter:Received:X-Virus-Scanned:Received:Received:DKIM-Filter: DKIM-Signature:Received:Received:From:To:CC:Subject:Date:Message-ID: X-Mailer:In-Reply-To:References:MIME-Version: Content-Transfer-Encoding:Content-Type:X-ClientProxiedBy; bh=Bhm5K5pgZZqGM+JSJ1uY6OfgTehxKhHFC60i5E2xYII=; b=qws+b1c0+1dLWHEtMdFSGfzF0LdVy6dE4UeMIeMuHZfwdE4ziVzHoiEmj6OZwJF+sKfd UzBBuOC5p1kJfoLRDTlFlINgUHpdQNrmFA44DNtZ9oL69NdNAnNx5o7VwalcCrISLWoc1 h8h4OE84VE4ViUm/lgcsy1Tk7StbTmWONR2brcejDvZGnNe9ZM7TlzYpKapyUa4Ee/Qwy I50eDK4WppwSBVV61atwyNMf+2HNvikJDJHoDhn0mKHfRIykJr9XvSSZpZMV1yNnZwobb E6znnOePlqJgzq9qF4Qs/yj1tqpK94sauo3Vteatr2xI2znilM9Ce0L8jpyhpmvr7wA== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=secunet.com; spf=pass smtp.mailfrom=secunet.com; dkim=pass header.d=secunet.com header.i=@secunet.com header.a=rsa-sha256 header.s=202301 header.b=gCtQtDBL; arc=none smtp.remote-ip=62.96.220.36 Received: from mx1.secunet.com (mx1.secunet.com [62.96.220.36]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3CDDE60A2611 for ; Mon, 2 Nov 2026 08:04:51 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org 3CDDE60A2611 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=secunet.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=secunet.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=secunet.com header.i=@secunet.com header.a=rsa-sha256 header.s=202301 header.b=gCtQtDBL Received: from localhost (localhost [127.0.0.1]) by mx1.secunet.com (Postfix) with ESMTP id 68AAA207BB; Mon, 2 Nov 2026 09:04:44 +0100 (CET) X-Virus-Scanned: by secunet Received: from mx1.secunet.com ([127.0.0.1]) by localhost (mx1.secunet.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rLl6jszmYsnY; Mon, 2 Nov 2026 09:04:43 +0100 (CET) Received: from EXCH-01.secunet.de (rl1.secunet.de [10.32.0.231]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.secunet.com (Postfix) with ESMTPS id BA2B1207B0; Mon, 2 Nov 2026 09:04:43 +0100 (CET) DKIM-Filter: OpenDKIM Filter v2.11.0 mx1.secunet.com BA2B1207B0 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=secunet.com; s=202301; t=1793606683; bh=Bhm5K5pgZZqGM+JSJ1uY6OfgTehxKhHFC60i5E2xYII=; h=From:To:CC:Subject:Date:In-Reply-To:References:From; b=gCtQtDBL1Iyvx1gTPo/WDYYoIntuP079LxBFwJt+0TBNqiqvWt4f7fTKjEHcaLD2m lM8TzI2cKoEaNZCxRBFT2pr1UmeIu117DptlZWSJVD3LpMvqgjXv4ivytBYhSBH7Yg GWPoSuEK0mUIm9mUdkvI/U0LH/RmWQ43DG6JXbJtdUwU40UYmJ9fXJzy+oXkWVl45o n33sqqg6XmJJFy52VbRfbNrT9L7YKE9buTYK/Trm9xAU4bcPY9Qx6FBetgFIhppIsI gXOAf2FN9DfJpKyIvmq3eXIeLM0yZBaFmOfPLznK2nwiDrqxN+WbQO3rq4cK799c05 OryHkUj7U57RQ== Received: from gauss4 (10.182.7.102) by EXCH-01.secunet.de (10.32.0.171) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.49; Mon, 2 Nov 2026 09:04:42 +0100 Received: (nullmailer pid 2505927 invoked by uid 1000); Mon, 02 Nov 2026 10:04:58 -0000 From: Steffen Klassert To: David Miller , Jakub Kicinski CC: Herbert Xu , Steffen Klassert , Subject: [PATCH 13/14] docs: xfrm: include mark in XFRM_MSG_MIGRATE_STATE EEXIST tuple Date: Mon, 2 Nov 2026 10:04:11 +0000 Message-ID: <20261102100451.2505200-14-steffen.klassert@secunet.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20261102100451.2505200-1-steffen.klassert@secunet.com> References: <20261102100451.2505200-1-steffen.klassert@secunet.com> X-Mailing-List: netdev@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain X-ClientProxiedBy: EXCH-04.secunet.de (10.32.0.184) To EXCH-01.secunet.de (10.32.0.171) From: Antony Antony Document mark as part of the EEXIST tuple and update the SA lookup description to match. Fixes: c13c0cc6f52e ("xfrm: add documentation for XFRM_MSG_MIGRATE_STATE") Signed-off-by: Antony Antony Signed-off-by: Steffen Klassert --- .../networking/xfrm/xfrm_migrate_state.rst | 25 +++++++++++++------ 1 file changed, 17 insertions(+), 8 deletions(-) diff --git a/Documentation/networking/xfrm/xfrm_migrate_state.rst b/Documentation/networking/xfrm/xfrm_migrate_state.rst index 9d53cb22b007..ca2c9e5aaf33 100644 --- a/Documentation/networking/xfrm/xfrm_migrate_state.rst +++ b/Documentation/networking/xfrm/xfrm_migrate_state.rst @@ -27,15 +27,20 @@ SA Identification ================= The struct is defined in ``include/uapi/linux/xfrm.h``. The SA is looked -up using ``xfrm_state_lookup()`` with ``id.spi``, -``id.daddr``, ``id.proto``, ``id.family``, and -``old_mark.v & old_mark.m`` as the mark key:: +up using ``xfrm_state_lookup_exact()`` with ``id.spi``, ``id.daddr``, +``id.proto``, ``id.family``, and an exact match against ``old_mark.v`` +and ``old_mark.m``. Unlike the data path, which uses a masked +comparison, this requires the SA's mark and mask to equal ``old_mark`` +exactly, so a broad-mask SA is never matched when a more specific one +was intended. If no such SA exists, ``-ESRCH`` is returned. + +The layout is:: struct xfrm_user_migrate_state { struct xfrm_usersa_id id; /* spi, daddr, proto, family */ xfrm_address_t new_daddr; xfrm_address_t new_saddr; - struct xfrm_mark old_mark; /* SA lookup: key = v & m */ + struct xfrm_mark old_mark; /* SA lookup key (exact v/m match) */ struct xfrm_selector new_sel; /* new selector (see Flags) */ __u32 new_reqid; __u32 flags; /* XFRM_MIGRATE_STATE_* */ @@ -72,8 +77,8 @@ inherits the value from the existing SA (omit-to-inherit). - Description * - ``XFRMA_MARK`` - Mark on the migrated SA (``struct xfrm_mark``). Absent inherits - ``old_mark``. To use no mark on the new SA, send ``XFRMA_MARK`` - with ``{0, 0}``. + the mark of the existing SA. To use no mark on the new SA, send + ``XFRMA_MARK`` with ``{0, 0}``. * - ``XFRMA_ENCAP`` - UDP encapsulation template; only ``UDP_ENCAP_ESPINUDP`` is supported. Set ``encap_type=0`` to remove encap. @@ -259,8 +264,12 @@ Attributes in the notification Error Handling ============== -If the target SA tuple (new daddr, SPI, proto, new family) is already -occupied, the operation returns ``-EEXIST`` before the migration begins. +If the target SA tuple (new daddr, SPI, proto, new family, mark) is +already occupied, the operation returns ``-EEXIST`` before the migration +begins. "Occupied" includes wildcard shadowing: an existing SA with a +broader mask (e.g. mark 0/0) claims every mark value, so it blocks +migrating to any more specific mark at the same tuple, not just an +exact mark/mask duplicate. The old SA remains intact and the operation is safe to retry after resolving the conflict. -- 2.53.0