[PATCH] xfrm: account XFRMA_IF_ID and XFRMA_OFFLOAD_DEV in msgsize helpers

[PATCH] xfrm: account XFRMA_IF_ID and XFRMA_OFFLOAD_DEV in msgsize helpers

[Adrian Martinez Garcia]

[-- Attachment #1: Type: text/plain, Size: 542 bytes --]

Hi,

The xfrm_acquire_msgsize(), xfrm_polexpire_msgsize() and xfrm_expire_msgsize()
helpers do not account for the XFRMA_IF_ID (8 B) and XFRMA_OFFLOAD_DEV
(12 B) attributes that their sibling builders emit. The deficit of up to
20 B can trigger BUG_ON(err < 0) in the callers -> latent kernel panic.

This is a sibling of CVE-2026-43107 (fix 7081d46d32 only corrected the
aevent pair; these three pairs were left unfixed).

Fixes: 7e6526404ade
Signed-off-by: Adrian Martinez <adrimg3196@gmail.com>

I used Claude Code to help with the audit.

[-- Attachment #2: 0001-xfrm-account-XFRMA_IF_ID-and-XFRMA_OFFLOAD_DEV.patch --]
[-- Type: application/octet-stream, Size: 3735 bytes --]

From 534cb2b5fb8da81677f2955aac8a98d9aa89694b Mon Sep 17 00:00:00 2001
From: Adrian Martinez <adrimg3196@gmail.com>
Date: Sun, 11 Oct 2026 06:53:31 +0000
Subject: [PATCH] xfrm: account XFRMA_IF_ID and XFRMA_OFFLOAD_DEV in
 acquire/polexpire/expire size calculations

xfrm_send_acquire() and xfrm_exp_policy_notify() allocate their reply skb
with xfrm_acquire_msgsize() and xfrm_polexpire_msgsize(), then build_acquire()
and build_polexpire() append attributes including XFRMA_IF_ID (when the
policy if_id is set) and XFRMA_OFFLOAD_DEV (when the policy is bound to an
xfrm offload device).  Neither size helper reserves space for these two
conditionally emitted attributes, so for policies carrying if_id, mark,
pcpu and/or an offload device the builders can run out of skb tailroom,
fail with -EMSGSIZE and hit BUG_ON(err < 0), turning a netlink event into
a kernel panic.

build_expire() has the same XFRMA_IF_ID undercount in xfrm_expire_msgsize();
its caller already handles -EMSGSIZE gracefully, so the only effect there
is a dropped EXPIRE notification.

This is the same bug class as CVE-2026-43107, whose fix (7081d46d32)
only covered the aevent pair.

Account XFRMA_IF_ID and XFRMA_OFFLOAD_DEV in the three size calculations
unconditionally, and replace the two BUG_ONs with normal error unwinding,
mirroring the aevent fix.

Fixes: 7e6526404ade ("xfrm: Add a new lookup key to match xfrm interfaces.")
Signed-off-by: Adrian Martinez <adrimg3196@gmail.com>
---
 net/xfrm/xfrm_user.c | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index a2587c7e..5eb79b0b 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -3927,7 +3927,8 @@ static inline unsigned int xfrm_expire_msgsize(void)
 	return NLMSG_ALIGN(sizeof(struct xfrm_user_expire)) +
 	       nla_total_size(sizeof(struct xfrm_mark)) +
 	       nla_total_size(sizeof_field(struct xfrm_state, dir)) +
-	       nla_total_size(4); /* XFRMA_SA_PCPU */
+	       nla_total_size(4) + /* XFRMA_SA_PCPU */
+	       nla_total_size(4); /* XFRMA_IF_ID */
 }
 
 static int build_expire(struct sk_buff *skb, struct xfrm_state *x, const struct km_event *c)
@@ -4177,6 +4178,8 @@ static inline unsigned int xfrm_acquire_msgsize(struct xfrm_state *x,
 	       + nla_total_size(sizeof(struct xfrm_mark))
 	       + nla_total_size(xfrm_user_sec_ctx_size(x->security))
 	       + nla_total_size(4) /* XFRMA_SA_PCPU */
+	       + nla_total_size(sizeof(xp->if_id)) /* XFRMA_IF_ID */
+	       + nla_total_size(sizeof(struct xfrm_user_offload)) /* XFRMA_OFFLOAD_DEV */
 	       + userpolicy_type_attrsize();
 }
 
@@ -4236,7 +4239,10 @@ static int xfrm_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *xt,
 		return -ENOMEM;
 
 	err = build_acquire(skb, x, xt, xp);
-	BUG_ON(err < 0);
+	if (err < 0) {
+		kfree_skb(skb);
+		return err;
+	}
 
 	return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_ACQUIRE);
 }
@@ -4307,6 +4313,8 @@ static inline unsigned int xfrm_polexpire_msgsize(struct xfrm_policy *xp)
 	       + nla_total_size(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr)
 	       + nla_total_size(xfrm_user_sec_ctx_size(xp->security))
 	       + nla_total_size(sizeof(struct xfrm_mark))
+	       + nla_total_size(sizeof(xp->if_id)) /* XFRMA_IF_ID */
+	       + nla_total_size(sizeof(struct xfrm_user_offload)) /* XFRMA_OFFLOAD_DEV */
 	       + userpolicy_type_attrsize();
 }
 
@@ -4358,7 +4366,10 @@ static int xfrm_exp_policy_notify(struct xfrm_policy *xp, int dir, const struct
 		return -ENOMEM;
 
 	err = build_polexpire(skb, xp, dir, c);
-	BUG_ON(err < 0);
+	if (err < 0) {
+		kfree_skb(skb);
+		return err;
+	}
 
 	return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_EXPIRE);
 }
-- 
2.43.0

Re: [PATCH] xfrm: account XFRMA_IF_ID and XFRMA_OFFLOAD_DEV in msgsize helpers

[Nicolas Dichtel]

Le 11/10/2026 à 10:06, Adrian Martinez Garcia a écrit :
> Hi,
> 
> The xfrm_acquire_msgsize(), xfrm_polexpire_msgsize() and xfrm_expire_msgsize()
> helpers do not account for the XFRMA_IF_ID (8 B) and XFRMA_OFFLOAD_DEV
> (12 B) attributes that their sibling builders emit. The deficit of up to
> 20 B can trigger BUG_ON(err < 0) in the callers -> latent kernel panic.
> 
> This is a sibling of CVE-2026-43107 (fix 7081d46d32 only corrected the
> aevent pair; these three pairs were left unfixed).
> 
> Fixes: 7e6526404ade
> Signed-off-by: Adrian Martinez <adrimg3196@gmail.com>
> 
> I used Claude Code to help with the audit.
Please, don't use attachments.

Here is the doc about the process:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/submitting-patches.rst#n278

Regards,
Nicolas