* [PATCH ipsec-next v2 0/4] xfrm: XFRM_MSG_MIGRATE_STATE new netlink message
@ 2026-01-17 20:04 Antony Antony
2026-01-17 19:58 ` [PATCH ipsec-next v2 1/4] xfrm: remove redundant assignments Antony Antony
` (3 more replies)
0 siblings, 4 replies; 10+ messages in thread
From: Antony Antony @ 2026-01-17 20:04 UTC (permalink / raw)
To: Antony Antony, Steffen Klassert, Herbert Xu, netdev
Cc: David S . Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Chiachang Wang, Yan Yan, devel
The current XFRM_MSG_MIGRATE interface is tightly coupled to policy and
SA migration, and it lacks the information required to reliably migrate
individual SAs. This makes it unsuitable for IKEv2 deployments,
dual-stack setups (IPv4/IPv6), and scenarios where policies are managed
externally (e.g., by other daemons than IKE daemon).
Mandatory SA selector list
The current API requires a non-empty SA selector list, which does not
reflect IKEv2 use case.
A single Child SA may correspond to multiple policies,
and SA discovery already occurs via address and reqid matching. With
dual-stack Child SAs this leads to excessive churn: the current method
would have to be called up to six times (in/out/fwd × v4/v6) on SA,
while the new method only requires two calls.
Selectors lack SPI (and marks)
XFRM_MSG_MIGRATE cannot uniquely identify an SA when multiple SAs share
the same policies (per-CPU SAs, SELinux label-based SAs, etc.). Without
the SPI, the kernel may update the wrong SA instance.
Reqid cannot be changed
Some implementations allocate reqids based on traffic selectors. In
host-to-host or selector-changing scenarios, the reqid must change,
which the current API cannot express.
Because strongSwan and other implementations manage policies
independently of the kernel, an interface that updates only a specific
SA - with complete and unambiguous identification - is required.
XFRM_MSG_MIGRATE_STATE provides that interface. It supports migration
of a single SA via xfrm_usersa_id (including SPI) and we fix
encap removal in this patch set, reqid updates, address changes,
and other SA-specific parameters. It avoids the structural limitations
of XFRM_MSG_MIGRATE and provides a simpler, extensible mechanism for
precise per-SA migration without involving policies.
New migration steps: first install block policy, remove the old policy,
call XFRM_MSG_MIGRATE_STATE for each state, then re-install the
policies and remove the block policy.
Antony Antony (4):
xfrm: remove redundant assignments
xfrm: allow migration from UDP encapsulated to non-encapsulated ESP
xfrm: rename reqid in xfrm_migrate
xfrm: add XFRM_MSG_MIGRATE_STATE for single SA migration
include/net/xfrm.h | 3 +-
include/uapi/linux/xfrm.h | 11 +++
net/key/af_key.c | 10 +--
net/xfrm/xfrm_policy.c | 4 +-
net/xfrm/xfrm_state.c | 34 +++-----
net/xfrm/xfrm_user.c | 164 +++++++++++++++++++++++++++++++++++-
security/selinux/nlmsgtab.c | 3 +-
7 files changed, 198 insertions(+), 31 deletions(-)
---
v1->v2: dropped 6/6. That check is already there where the func is called
- merged patch 4/6 and 5/6, to fix use uninitialized value
- fix commit messages
v2->v3: fix commit message
- fixes to error path
---
-antony
^ permalink raw reply [flat|nested] 10+ messages in thread* [PATCH ipsec-next v2 1/4] xfrm: remove redundant assignments 2026-01-17 20:04 [PATCH ipsec-next v2 0/4] xfrm: XFRM_MSG_MIGRATE_STATE new netlink message Antony Antony @ 2026-01-17 19:58 ` Antony Antony 2026-01-17 19:59 ` Antony Antony 2026-01-17 20:06 ` Antony Antony 2026-01-17 20:06 ` [PATCH ipsec-next v2 2/4] xfrm: allow migration from UDP encapsulated to non-encapsulated ESP Antony Antony ` (2 subsequent siblings) 3 siblings, 2 replies; 10+ messages in thread From: Antony Antony @ 2026-01-17 19:58 UTC (permalink / raw) To: Antony Antony, Steffen Klassert, Herbert Xu, netdev Cc: David S . Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni, Chiachang Wang, Yan Yan, devel, Simon Horman, linux-kernel This assignments are overwritten within the same function further down commit e8961c50ee9cc ("xfrm: Refactor migration setup during the cloning process") x->props.family = m->new_family; Which actually moved it in the commit e03c3bba351f9 ("xfrm: Fix xfrm migrate issues when address family changes") And the initial commit 80c9abaabf428 ("[XFRM]: Extension for dynamic update of endpoint address(es)") added x->props.saddr = orig->props.saddr; and memcpy(&xc->props.saddr, &m->new_saddr, sizeof(xc->props.saddr)); Signed-off-by: Antony Antony <antony.antony@secunet.com> -- v1->v2: remove extra saddr copy, previous line --- net/xfrm/xfrm_state.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c index 9e14e453b55c..4fd73a970a7a 100644 --- a/net/xfrm/xfrm_state.c +++ b/net/xfrm/xfrm_state.c @@ -1980,8 +1980,6 @@ static struct xfrm_state *xfrm_state_clone_and_setup(struct xfrm_state *orig, x->props.mode = orig->props.mode; x->props.replay_window = orig->props.replay_window; x->props.reqid = orig->props.reqid; - x->props.family = orig->props.family; - x->props.saddr = orig->props.saddr; if (orig->aalg) { x->aalg = xfrm_algo_auth_clone(orig->aalg); -- 2.39.5 ^ permalink raw reply related [flat|nested] 10+ messages in thread
* [PATCH ipsec-next v2 1/4] xfrm: remove redundant assignments 2026-01-17 19:58 ` [PATCH ipsec-next v2 1/4] xfrm: remove redundant assignments Antony Antony @ 2026-01-17 19:59 ` Antony Antony 2026-01-17 20:06 ` Antony Antony 1 sibling, 0 replies; 10+ messages in thread From: Antony Antony @ 2026-01-17 19:59 UTC (permalink / raw) To: Antony Antony, Steffen Klassert, Herbert Xu, netdev Cc: David S . Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni, Chiachang Wang, Yan Yan, devel, Simon Horman, linux-kernel This assignments are overwritten within the same function further down commit e8961c50ee9cc ("xfrm: Refactor migration setup during the cloning process") x->props.family = m->new_family; Which actually moved it in the commit e03c3bba351f9 ("xfrm: Fix xfrm migrate issues when address family changes") And the initial commit 80c9abaabf428 ("[XFRM]: Extension for dynamic update of endpoint address(es)") added x->props.saddr = orig->props.saddr; and memcpy(&xc->props.saddr, &m->new_saddr, sizeof(xc->props.saddr)); Signed-off-by: Antony Antony <antony.antony@secunet.com> -- v1->v2: remove extra saddr copy, previous line --- net/xfrm/xfrm_state.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c index 9e14e453b55c..4fd73a970a7a 100644 --- a/net/xfrm/xfrm_state.c +++ b/net/xfrm/xfrm_state.c @@ -1980,8 +1980,6 @@ static struct xfrm_state *xfrm_state_clone_and_setup(struct xfrm_state *orig, x->props.mode = orig->props.mode; x->props.replay_window = orig->props.replay_window; x->props.reqid = orig->props.reqid; - x->props.family = orig->props.family; - x->props.saddr = orig->props.saddr; if (orig->aalg) { x->aalg = xfrm_algo_auth_clone(orig->aalg); -- 2.39.5 ^ permalink raw reply related [flat|nested] 10+ messages in thread
* [PATCH ipsec-next v2 1/4] xfrm: remove redundant assignments 2026-01-17 19:58 ` [PATCH ipsec-next v2 1/4] xfrm: remove redundant assignments Antony Antony 2026-01-17 19:59 ` Antony Antony @ 2026-01-17 20:06 ` Antony Antony 1 sibling, 0 replies; 10+ messages in thread From: Antony Antony @ 2026-01-17 20:06 UTC (permalink / raw) To: Antony Antony, Steffen Klassert, Herbert Xu, netdev Cc: David S . Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni, Chiachang Wang, Yan Yan, devel, Simon Horman, linux-kernel This assignments are overwritten within the same function further down commit e8961c50ee9cc ("xfrm: Refactor migration setup during the cloning process") x->props.family = m->new_family; Which actually moved it in the commit e03c3bba351f9 ("xfrm: Fix xfrm migrate issues when address family changes") And the initial commit 80c9abaabf428 ("[XFRM]: Extension for dynamic update of endpoint address(es)") added x->props.saddr = orig->props.saddr; and memcpy(&xc->props.saddr, &m->new_saddr, sizeof(xc->props.saddr)); Signed-off-by: Antony Antony <antony.antony@secunet.com> --- v1->v2: remove extra saddr copy, previous line --- net/xfrm/xfrm_state.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c index 9e14e453b55c..4fd73a970a7a 100644 --- a/net/xfrm/xfrm_state.c +++ b/net/xfrm/xfrm_state.c @@ -1980,8 +1980,6 @@ static struct xfrm_state *xfrm_state_clone_and_setup(struct xfrm_state *orig, x->props.mode = orig->props.mode; x->props.replay_window = orig->props.replay_window; x->props.reqid = orig->props.reqid; - x->props.family = orig->props.family; - x->props.saddr = orig->props.saddr; if (orig->aalg) { x->aalg = xfrm_algo_auth_clone(orig->aalg); -- 2.39.5 ^ permalink raw reply related [flat|nested] 10+ messages in thread
* [PATCH ipsec-next v2 2/4] xfrm: allow migration from UDP encapsulated to non-encapsulated ESP 2026-01-17 20:04 [PATCH ipsec-next v2 0/4] xfrm: XFRM_MSG_MIGRATE_STATE new netlink message Antony Antony 2026-01-17 19:58 ` [PATCH ipsec-next v2 1/4] xfrm: remove redundant assignments Antony Antony @ 2026-01-17 20:06 ` Antony Antony 2026-01-17 20:07 ` [PATCH ipsec-next v2 3/4] xfrm: rename reqid in xfrm_migrate Antony Antony 2026-01-17 20:07 ` [PATCH ipsec-next v2 4/4] xfrm: add XFRM_MSG_MIGRATE_STATE for single SA migration Antony Antony 3 siblings, 0 replies; 10+ messages in thread From: Antony Antony @ 2026-01-17 20:06 UTC (permalink / raw) To: Antony Antony, Steffen Klassert, Herbert Xu, netdev Cc: David S . Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni, Chiachang Wang, Yan Yan, devel, Simon Horman, linux-kernel The current code prevents migrating an SA from UDP encapsulation to plain ESP. This is needed when moving from a NATed path to a non-NATed one, for example when switching from IPv4+NAT to IPv6. Only copy the existing encapsulation during migration if the encap attribute is explicitly provided. Signed-off-by: Antony Antony <antony.antony@secunet.com> --- net/xfrm/xfrm_state.c | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c index 4fd73a970a7a..f5f699f5f98e 100644 --- a/net/xfrm/xfrm_state.c +++ b/net/xfrm/xfrm_state.c @@ -2008,14 +2008,8 @@ static struct xfrm_state *xfrm_state_clone_and_setup(struct xfrm_state *orig, } x->props.calgo = orig->props.calgo; - if (encap || orig->encap) { - if (encap) - x->encap = kmemdup(encap, sizeof(*x->encap), - GFP_KERNEL); - else - x->encap = kmemdup(orig->encap, sizeof(*x->encap), - GFP_KERNEL); - + if (encap) { + x->encap = kmemdup(encap, sizeof(*x->encap), GFP_KERNEL); if (!x->encap) goto error; } -- 2.39.5 ^ permalink raw reply related [flat|nested] 10+ messages in thread
* [PATCH ipsec-next v2 3/4] xfrm: rename reqid in xfrm_migrate 2026-01-17 20:04 [PATCH ipsec-next v2 0/4] xfrm: XFRM_MSG_MIGRATE_STATE new netlink message Antony Antony 2026-01-17 19:58 ` [PATCH ipsec-next v2 1/4] xfrm: remove redundant assignments Antony Antony 2026-01-17 20:06 ` [PATCH ipsec-next v2 2/4] xfrm: allow migration from UDP encapsulated to non-encapsulated ESP Antony Antony @ 2026-01-17 20:07 ` Antony Antony 2026-01-17 20:07 ` [PATCH ipsec-next v2 4/4] xfrm: add XFRM_MSG_MIGRATE_STATE for single SA migration Antony Antony 3 siblings, 0 replies; 10+ messages in thread From: Antony Antony @ 2026-01-17 20:07 UTC (permalink / raw) To: Antony Antony, Steffen Klassert, Herbert Xu, netdev Cc: David S . Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni, Chiachang Wang, Yan Yan, devel, Simon Horman, linux-kernel In preparation for the following patch rename s/reqid/old_reqid/. Signed-off-by: Antony Antony <antony.antony@secunet.com> --- include/net/xfrm.h | 2 +- net/key/af_key.c | 10 +++++----- net/xfrm/xfrm_policy.c | 4 ++-- net/xfrm/xfrm_state.c | 6 +++--- net/xfrm/xfrm_user.c | 4 ++-- 5 files changed, 13 insertions(+), 13 deletions(-) diff --git a/include/net/xfrm.h b/include/net/xfrm.h index 0a14daaa5dd4..05fa0552523d 100644 --- a/include/net/xfrm.h +++ b/include/net/xfrm.h @@ -685,7 +685,7 @@ struct xfrm_migrate { u8 proto; u8 mode; u16 reserved; - u32 reqid; + u32 old_reqid; u16 old_family; u16 new_family; }; diff --git a/net/key/af_key.c b/net/key/af_key.c index 571200433aa9..a856bdd0c0d7 100644 --- a/net/key/af_key.c +++ b/net/key/af_key.c @@ -2538,7 +2538,7 @@ static int ipsecrequests_to_migrate(struct sadb_x_ipsecrequest *rq1, int len, if ((mode = pfkey_mode_to_xfrm(rq1->sadb_x_ipsecrequest_mode)) < 0) return -EINVAL; m->mode = mode; - m->reqid = rq1->sadb_x_ipsecrequest_reqid; + m->old_reqid = rq1->sadb_x_ipsecrequest_reqid; return ((int)(rq1->sadb_x_ipsecrequest_len + rq2->sadb_x_ipsecrequest_len)); @@ -3634,15 +3634,15 @@ static int pfkey_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type, if (mode < 0) goto err; if (set_ipsecrequest(skb, mp->proto, mode, - (mp->reqid ? IPSEC_LEVEL_UNIQUE : IPSEC_LEVEL_REQUIRE), - mp->reqid, mp->old_family, + (mp->old_reqid ? IPSEC_LEVEL_UNIQUE : IPSEC_LEVEL_REQUIRE), + mp->old_reqid, mp->old_family, &mp->old_saddr, &mp->old_daddr) < 0) goto err; /* new ipsecrequest */ if (set_ipsecrequest(skb, mp->proto, mode, - (mp->reqid ? IPSEC_LEVEL_UNIQUE : IPSEC_LEVEL_REQUIRE), - mp->reqid, mp->new_family, + (mp->old_reqid ? IPSEC_LEVEL_UNIQUE : IPSEC_LEVEL_REQUIRE), + mp->old_reqid, mp->new_family, &mp->new_saddr, &mp->new_daddr) < 0) goto err; } diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c index 62486f866975..854dfc16ed55 100644 --- a/net/xfrm/xfrm_policy.c +++ b/net/xfrm/xfrm_policy.c @@ -4530,7 +4530,7 @@ static int migrate_tmpl_match(const struct xfrm_migrate *m, const struct xfrm_tm int match = 0; if (t->mode == m->mode && t->id.proto == m->proto && - (m->reqid == 0 || t->reqid == m->reqid)) { + (m->old_reqid == 0 || t->reqid == m->old_reqid)) { switch (t->mode) { case XFRM_MODE_TUNNEL: case XFRM_MODE_BEET: @@ -4624,7 +4624,7 @@ static int xfrm_migrate_check(const struct xfrm_migrate *m, int num_migrate, sizeof(m[i].old_saddr)) && m[i].proto == m[j].proto && m[i].mode == m[j].mode && - m[i].reqid == m[j].reqid && + m[i].old_reqid == m[j].old_reqid && m[i].old_family == m[j].old_family) { NL_SET_ERR_MSG(extack, "Entries in the MIGRATE attribute's list must be unique"); return -EINVAL; diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c index f5f699f5f98e..fe595d7f4398 100644 --- a/net/xfrm/xfrm_state.c +++ b/net/xfrm/xfrm_state.c @@ -2080,14 +2080,14 @@ struct xfrm_state *xfrm_migrate_state_find(struct xfrm_migrate *m, struct net *n spin_lock_bh(&net->xfrm.xfrm_state_lock); - if (m->reqid) { + if (m->old_reqid) { h = xfrm_dst_hash(net, &m->old_daddr, &m->old_saddr, - m->reqid, m->old_family); + m->old_reqid, m->old_family); hlist_for_each_entry(x, net->xfrm.state_bydst+h, bydst) { if (x->props.mode != m->mode || x->id.proto != m->proto) continue; - if (m->reqid && x->props.reqid != m->reqid) + if (m->old_reqid && x->props.reqid != m->old_reqid) continue; if (if_id != 0 && x->if_id != if_id) continue; diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c index 403b5ecac2c5..26b82d94acc1 100644 --- a/net/xfrm/xfrm_user.c +++ b/net/xfrm/xfrm_user.c @@ -3087,7 +3087,7 @@ static int copy_from_user_migrate(struct xfrm_migrate *ma, ma->proto = um->proto; ma->mode = um->mode; - ma->reqid = um->reqid; + ma->old_reqid = um->reqid; ma->old_family = um->old_family; ma->new_family = um->new_family; @@ -3170,7 +3170,7 @@ static int copy_to_user_migrate(const struct xfrm_migrate *m, struct sk_buff *sk memset(&um, 0, sizeof(um)); um.proto = m->proto; um.mode = m->mode; - um.reqid = m->reqid; + um.reqid = m->old_reqid; um.old_family = m->old_family; memcpy(&um.old_daddr, &m->old_daddr, sizeof(um.old_daddr)); memcpy(&um.old_saddr, &m->old_saddr, sizeof(um.old_saddr)); -- 2.39.5 ^ permalink raw reply related [flat|nested] 10+ messages in thread
* [PATCH ipsec-next v2 4/4] xfrm: add XFRM_MSG_MIGRATE_STATE for single SA migration 2026-01-17 20:04 [PATCH ipsec-next v2 0/4] xfrm: XFRM_MSG_MIGRATE_STATE new netlink message Antony Antony ` (2 preceding siblings ...) 2026-01-17 20:07 ` [PATCH ipsec-next v2 3/4] xfrm: rename reqid in xfrm_migrate Antony Antony @ 2026-01-17 20:07 ` Antony Antony 2026-01-19 5:27 ` Dan Carpenter 3 siblings, 1 reply; 10+ messages in thread From: Antony Antony @ 2026-01-17 20:07 UTC (permalink / raw) To: Antony Antony, Steffen Klassert, Herbert Xu, netdev Cc: David S . Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni, Chiachang Wang, Yan Yan, devel, Simon Horman, Paul Moore, Stephen Smalley, Ondrej Mosnacek, linux-kernel, selinux Add a new netlink method to migrate a single xfrm_state. Unlike the existing migration mechanism (SA + policy), this supports migrating only the SA and allows changing the reqid. The reqid is invariant in old migration. Signed-off-by: Antony Antony <antony.antony@secunet.com> --- v1->v2: merged next patch here to fix use uninitialized value - removed unnecessary inline - added const when possible v2->v3: free the skb on the error path --- include/net/xfrm.h | 1 + include/uapi/linux/xfrm.h | 11 +++ net/xfrm/xfrm_state.c | 16 ++-- net/xfrm/xfrm_user.c | 160 ++++++++++++++++++++++++++++++++++++ security/selinux/nlmsgtab.c | 3 +- 5 files changed, 183 insertions(+), 8 deletions(-) diff --git a/include/net/xfrm.h b/include/net/xfrm.h index 05fa0552523d..4147c5ba6093 100644 --- a/include/net/xfrm.h +++ b/include/net/xfrm.h @@ -686,6 +686,7 @@ struct xfrm_migrate { u8 mode; u16 reserved; u32 old_reqid; + u32 new_reqid; u16 old_family; u16 new_family; }; diff --git a/include/uapi/linux/xfrm.h b/include/uapi/linux/xfrm.h index a23495c0e0a1..60b1f201b237 100644 --- a/include/uapi/linux/xfrm.h +++ b/include/uapi/linux/xfrm.h @@ -227,6 +227,9 @@ enum { #define XFRM_MSG_SETDEFAULT XFRM_MSG_SETDEFAULT XFRM_MSG_GETDEFAULT, #define XFRM_MSG_GETDEFAULT XFRM_MSG_GETDEFAULT + + XFRM_MSG_MIGRATE_STATE, +#define XFRM_MSG_MIGRATE_STATE XFRM_MSG_MIGRATE_STATE __XFRM_MSG_MAX }; #define XFRM_MSG_MAX (__XFRM_MSG_MAX - 1) @@ -507,6 +510,14 @@ struct xfrm_user_migrate { __u16 new_family; }; +struct xfrm_user_migrate_state { + struct xfrm_usersa_id id; + xfrm_address_t new_saddr; + xfrm_address_t new_daddr; + __u16 new_family; + __u32 new_reqid; +}; + struct xfrm_user_mapping { struct xfrm_usersa_id id; __u32 reqid; diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c index fe595d7f4398..8d4f82bab8fc 100644 --- a/net/xfrm/xfrm_state.c +++ b/net/xfrm/xfrm_state.c @@ -1966,8 +1966,8 @@ static inline int clone_security(struct xfrm_state *x, struct xfrm_sec_ctx *secu } static struct xfrm_state *xfrm_state_clone_and_setup(struct xfrm_state *orig, - struct xfrm_encap_tmpl *encap, - struct xfrm_migrate *m) + const struct xfrm_encap_tmpl *encap, + const struct xfrm_migrate *m) { struct net *net = xs_net(orig); struct xfrm_state *x = xfrm_state_alloc(net); @@ -1979,7 +1979,6 @@ static struct xfrm_state *xfrm_state_clone_and_setup(struct xfrm_state *orig, memcpy(&x->lft, &orig->lft, sizeof(x->lft)); x->props.mode = orig->props.mode; x->props.replay_window = orig->props.replay_window; - x->props.reqid = orig->props.reqid; if (orig->aalg) { x->aalg = xfrm_algo_auth_clone(orig->aalg); @@ -2058,7 +2057,7 @@ static struct xfrm_state *xfrm_state_clone_and_setup(struct xfrm_state *orig, goto error; } - + x->props.reqid = m->new_reqid; x->props.family = m->new_family; memcpy(&x->id.daddr, &m->new_daddr, sizeof(x->id.daddr)); memcpy(&x->props.saddr, &m->new_saddr, sizeof(x->props.saddr)); @@ -2145,9 +2144,12 @@ struct xfrm_state *xfrm_state_migrate(struct xfrm_state *x, goto error; /* add state */ - if (xfrm_addr_equal(&x->id.daddr, &m->new_daddr, m->new_family)) { - /* a care is needed when the destination address of the - state is to be updated as it is a part of triplet */ + if (xfrm_addr_equal(&x->id.daddr, &m->new_daddr, m->new_family) || + x->props.reqid != xc->props.reqid) { + /* + * a care is needed when the destination address or the reqid + * of the state is to be updated as it is a part of triplet + */ xfrm_state_insert(xc); } else { if (xfrm_state_add(xc) < 0) diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c index 26b82d94acc1..cf5a4bda3161 100644 --- a/net/xfrm/xfrm_user.c +++ b/net/xfrm/xfrm_user.c @@ -3052,6 +3052,22 @@ static int xfrm_add_acquire(struct sk_buff *skb, struct nlmsghdr *nlh, } #ifdef CONFIG_XFRM_MIGRATE +static int copy_from_user_migrate_state(struct xfrm_migrate *ma, + const struct xfrm_user_migrate_state *um) +{ + memcpy(&ma->old_daddr, &um->id.daddr, sizeof(ma->old_daddr)); + memcpy(&ma->new_daddr, &um->new_daddr, sizeof(ma->new_daddr)); + memcpy(&ma->new_saddr, &um->new_saddr, sizeof(ma->new_saddr)); + + ma->proto = um->id.proto; + ma->new_reqid = um->new_reqid; + + ma->old_family = um->id.family; + ma->new_family = um->new_family; + + return 0; +} + static int copy_from_user_migrate(struct xfrm_migrate *ma, struct xfrm_kmaddress *k, struct nlattr **attrs, int *num, @@ -3088,6 +3104,7 @@ static int copy_from_user_migrate(struct xfrm_migrate *ma, ma->proto = um->proto; ma->mode = um->mode; ma->old_reqid = um->reqid; + ma->new_reqid = um->reqid; /* reqid is invariant in XFRM_MSG_MIGRATE */ ma->old_family = um->old_family; ma->new_family = um->new_family; @@ -3154,7 +3171,148 @@ static int xfrm_do_migrate(struct sk_buff *skb, struct nlmsghdr *nlh, kfree(xuo); return err; } + +static int build_migrate_state(struct sk_buff *skb, + const struct xfrm_user_migrate_state *m, + const struct xfrm_encap_tmpl *encap, + const struct xfrm_user_offload *xuo) +{ + int err; + struct nlmsghdr *nlh; + struct xfrm_user_migrate_state *um; + + nlh = nlmsg_put(skb, 0, 0, XFRM_MSG_MIGRATE_STATE, + sizeof(struct xfrm_user_migrate_state), 0); + if (!nlh) + return -EMSGSIZE; + + um = nlmsg_data(nlh); + *um = *m; + + if (encap) { + err = nla_put(skb, XFRMA_ENCAP, sizeof(*encap), encap); + if (err) + goto out_cancel; + } + + if (xuo) { + err = nla_put(skb, XFRMA_OFFLOAD_DEV, sizeof(*xuo), xuo); + if (err) + goto out_cancel; + } + + nlmsg_end(skb, nlh); + return 0; + +out_cancel: + nlmsg_cancel(skb, nlh); + return err; +} + +static unsigned int xfrm_migrate_state_msgsize(bool with_encap, bool with_xuo) +{ + return NLMSG_ALIGN(sizeof(struct xfrm_user_migrate_state)) + + (with_encap ? nla_total_size(sizeof(struct xfrm_encap_tmpl)) : 0) + + (with_xuo ? nla_total_size(sizeof(struct xfrm_user_offload)) : 0); +} + +static int xfrm_send_migrate_state(const struct xfrm_user_migrate_state *um, + const struct xfrm_encap_tmpl *encap, + const struct xfrm_user_offload *xuo) +{ + int err; + struct sk_buff *skb; + struct net *net = &init_net; + + skb = nlmsg_new(xfrm_migrate_state_msgsize(!!encap, !!xuo), GFP_ATOMIC); + if (!skb) + return -ENOMEM; + + err = build_migrate_state(skb, um, encap, xuo); + if (err < 0) { + kfree_skb(skb); + return err; + } + + return xfrm_nlmsg_multicast(net, skb, 0, XFRMNLGRP_MIGRATE); +} + +static int xfrm_do_migrate_state(struct sk_buff *skb, struct nlmsghdr *nlh, + struct nlattr **attrs, struct netlink_ext_ack *extack) +{ + int err = -ESRCH; + struct xfrm_state *x; + struct net *net = sock_net(skb->sk); + struct xfrm_encap_tmpl *encap = NULL; + struct xfrm_user_offload *xuo = NULL; + struct xfrm_migrate m = { .old_saddr.a4 = 0,}; + struct xfrm_user_migrate_state *um = nlmsg_data(nlh); + + if (!um->id.spi) { + NL_SET_ERR_MSG(extack, "Invalid SPI 0x0"); + return -EINVAL; + } + + err = copy_from_user_migrate_state(&m, um); + if (err) + return err; + + x = xfrm_user_state_lookup(net, &um->id, attrs, &err); + + if (x) { + struct xfrm_state *xc; + + if (!x->dir) { + NL_SET_ERR_MSG(extack, "State direction is invalid"); + err = -EINVAL; + goto error; + } + + if (attrs[XFRMA_ENCAP]) { + encap = kmemdup(nla_data(attrs[XFRMA_ENCAP]), + sizeof(*encap), GFP_KERNEL); + if (!encap) { + err = -ENOMEM; + goto error; + } + } + if (attrs[XFRMA_OFFLOAD_DEV]) { + xuo = kmemdup(nla_data(attrs[XFRMA_OFFLOAD_DEV]), + sizeof(*xuo), GFP_KERNEL); + if (!xuo) { + err = -ENOMEM; + goto error; + } + } + xc = xfrm_state_migrate(x, &m, encap, net, xuo, extack); + if (xc) { + xfrm_state_delete(x); + xfrm_send_migrate_state(um, encap, xuo); + err = 0; + } else { + if (extack && !extack->_msg) + NL_SET_ERR_MSG(extack, "State migration clone failed"); + err = -EINVAL; + } + } else { + NL_SET_ERR_MSG(extack, "Can not find state"); + return err; + } +error: + xfrm_state_put(x); + kfree(encap); + kfree(xuo); + return err; +} + #else +static int xfrm_do_migrate_state(struct sk_buff *skb, struct nlmsghdr *nlh, + struct nlattr **attrs, struct netlink_ext_ack *extack) +{ + NL_SET_ERR_MSG(extack, "XFRM_MSG_MIGRATE_STATE is not supported"); + return -ENOPROTOOPT; +} + static int xfrm_do_migrate(struct sk_buff *skb, struct nlmsghdr *nlh, struct nlattr **attrs, struct netlink_ext_ack *extack) { @@ -3307,6 +3465,7 @@ const int xfrm_msg_min[XFRM_NR_MSGTYPES] = { [XFRM_MSG_GETSPDINFO - XFRM_MSG_BASE] = sizeof(u32), [XFRM_MSG_SETDEFAULT - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_default), [XFRM_MSG_GETDEFAULT - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_default), + [XFRM_MSG_MIGRATE_STATE - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_migrate_state), }; EXPORT_SYMBOL_GPL(xfrm_msg_min); @@ -3400,6 +3559,7 @@ static const struct xfrm_link { [XFRM_MSG_GETSPDINFO - XFRM_MSG_BASE] = { .doit = xfrm_get_spdinfo }, [XFRM_MSG_SETDEFAULT - XFRM_MSG_BASE] = { .doit = xfrm_set_default }, [XFRM_MSG_GETDEFAULT - XFRM_MSG_BASE] = { .doit = xfrm_get_default }, + [XFRM_MSG_MIGRATE_STATE - XFRM_MSG_BASE] = { .doit = xfrm_do_migrate_state }, }; static int xfrm_reject_unused_attr(int type, struct nlattr **attrs, diff --git a/security/selinux/nlmsgtab.c b/security/selinux/nlmsgtab.c index 2c0b07f9fbbd..655d2616c9d2 100644 --- a/security/selinux/nlmsgtab.c +++ b/security/selinux/nlmsgtab.c @@ -128,6 +128,7 @@ static const struct nlmsg_perm nlmsg_xfrm_perms[] = { { XFRM_MSG_MAPPING, NETLINK_XFRM_SOCKET__NLMSG_READ }, { XFRM_MSG_SETDEFAULT, NETLINK_XFRM_SOCKET__NLMSG_WRITE }, { XFRM_MSG_GETDEFAULT, NETLINK_XFRM_SOCKET__NLMSG_READ }, + { XFRM_MSG_MIGRATE_STATE, NETLINK_XFRM_SOCKET__NLMSG_WRITE }, }; static const struct nlmsg_perm nlmsg_audit_perms[] = { @@ -203,7 +204,7 @@ int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm) * structures at the top of this file with the new mappings * before updating the BUILD_BUG_ON() macro! */ - BUILD_BUG_ON(XFRM_MSG_MAX != XFRM_MSG_GETDEFAULT); + BUILD_BUG_ON(XFRM_MSG_MAX != XFRM_MSG_MIGRATE_STATE); if (selinux_policycap_netlink_xperm()) { *perm = NETLINK_XFRM_SOCKET__NLMSG; -- 2.39.5 ^ permalink raw reply related [flat|nested] 10+ messages in thread
* Re: [PATCH ipsec-next v2 4/4] xfrm: add XFRM_MSG_MIGRATE_STATE for single SA migration 2026-01-17 20:07 ` [PATCH ipsec-next v2 4/4] xfrm: add XFRM_MSG_MIGRATE_STATE for single SA migration Antony Antony @ 2026-01-19 5:27 ` Dan Carpenter 2026-01-19 8:21 ` [devel-ipsec] " Antony Antony 0 siblings, 1 reply; 10+ messages in thread From: Dan Carpenter @ 2026-01-19 5:27 UTC (permalink / raw) To: oe-kbuild, Antony Antony, Steffen Klassert, Herbert Xu, netdev Cc: lkp, oe-kbuild-all, David S . Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni, Chiachang Wang, Yan Yan, devel, Simon Horman, Paul Moore, Stephen Smalley, Ondrej Mosnacek, linux-kernel, selinux Hi Antony, kernel test robot noticed the following build warnings: https://git-scm.com/docs/git-format-patch#_base_tree_information] url: https://github.com/intel-lab-lkp/linux/commits/Antony-Antony/xfrm-remove-redundant-assignments/20260118-041031 base: https://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next.git master patch link: https://lore.kernel.org/r/951cb30ac3866c6075bc7359d0997dbffc3ce6da.1768679141.git.antony.antony%40secunet.com patch subject: [PATCH ipsec-next v2 4/4] xfrm: add XFRM_MSG_MIGRATE_STATE for single SA migration config: hexagon-randconfig-r072-20260118 (https://download.01.org/0day-ci/archive/20260119/202601190605.ZVkgcUYl-lkp@intel.com/config) compiler: clang version 22.0.0git (https://github.com/llvm/llvm-project 9b8addffa70cee5b2acc5454712d9cf78ce45710) smatch version: v0.5.0-8985-g2614ff1a If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp@intel.com> | Reported-by: Dan Carpenter <dan.carpenter@linaro.org> | Closes: https://lore.kernel.org/r/202601190605.ZVkgcUYl-lkp@intel.com/ New smatch warnings: net/xfrm/xfrm_user.c:3299 xfrm_do_migrate_state() warn: missing error code? 'err' Old smatch warnings: net/xfrm/xfrm_user.c:1024 xfrm_add_sa() warn: missing error code? 'err' net/xfrm/xfrm_user.c:2248 xfrm_add_policy() warn: missing error code? 'err' net/xfrm/xfrm_user.c:3018 xfrm_add_acquire() warn: missing error code 'err' vim +/err +3299 net/xfrm/xfrm_user.c d3019c1db87425 Antony Antony 2026-01-17 3240 static int xfrm_do_migrate_state(struct sk_buff *skb, struct nlmsghdr *nlh, d3019c1db87425 Antony Antony 2026-01-17 3241 struct nlattr **attrs, struct netlink_ext_ack *extack) d3019c1db87425 Antony Antony 2026-01-17 3242 { d3019c1db87425 Antony Antony 2026-01-17 3243 int err = -ESRCH; d3019c1db87425 Antony Antony 2026-01-17 3244 struct xfrm_state *x; d3019c1db87425 Antony Antony 2026-01-17 3245 struct net *net = sock_net(skb->sk); d3019c1db87425 Antony Antony 2026-01-17 3246 struct xfrm_encap_tmpl *encap = NULL; d3019c1db87425 Antony Antony 2026-01-17 3247 struct xfrm_user_offload *xuo = NULL; d3019c1db87425 Antony Antony 2026-01-17 3248 struct xfrm_migrate m = { .old_saddr.a4 = 0,}; d3019c1db87425 Antony Antony 2026-01-17 3249 struct xfrm_user_migrate_state *um = nlmsg_data(nlh); d3019c1db87425 Antony Antony 2026-01-17 3250 d3019c1db87425 Antony Antony 2026-01-17 3251 if (!um->id.spi) { d3019c1db87425 Antony Antony 2026-01-17 3252 NL_SET_ERR_MSG(extack, "Invalid SPI 0x0"); d3019c1db87425 Antony Antony 2026-01-17 3253 return -EINVAL; d3019c1db87425 Antony Antony 2026-01-17 3254 } d3019c1db87425 Antony Antony 2026-01-17 3255 d3019c1db87425 Antony Antony 2026-01-17 3256 err = copy_from_user_migrate_state(&m, um); d3019c1db87425 Antony Antony 2026-01-17 3257 if (err) d3019c1db87425 Antony Antony 2026-01-17 3258 return err; d3019c1db87425 Antony Antony 2026-01-17 3259 d3019c1db87425 Antony Antony 2026-01-17 3260 x = xfrm_user_state_lookup(net, &um->id, attrs, &err); d3019c1db87425 Antony Antony 2026-01-17 3261 d3019c1db87425 Antony Antony 2026-01-17 3262 if (x) { d3019c1db87425 Antony Antony 2026-01-17 3263 struct xfrm_state *xc; d3019c1db87425 Antony Antony 2026-01-17 3264 d3019c1db87425 Antony Antony 2026-01-17 3265 if (!x->dir) { d3019c1db87425 Antony Antony 2026-01-17 3266 NL_SET_ERR_MSG(extack, "State direction is invalid"); d3019c1db87425 Antony Antony 2026-01-17 3267 err = -EINVAL; d3019c1db87425 Antony Antony 2026-01-17 3268 goto error; d3019c1db87425 Antony Antony 2026-01-17 3269 } d3019c1db87425 Antony Antony 2026-01-17 3270 d3019c1db87425 Antony Antony 2026-01-17 3271 if (attrs[XFRMA_ENCAP]) { d3019c1db87425 Antony Antony 2026-01-17 3272 encap = kmemdup(nla_data(attrs[XFRMA_ENCAP]), d3019c1db87425 Antony Antony 2026-01-17 3273 sizeof(*encap), GFP_KERNEL); d3019c1db87425 Antony Antony 2026-01-17 3274 if (!encap) { d3019c1db87425 Antony Antony 2026-01-17 3275 err = -ENOMEM; d3019c1db87425 Antony Antony 2026-01-17 3276 goto error; d3019c1db87425 Antony Antony 2026-01-17 3277 } d3019c1db87425 Antony Antony 2026-01-17 3278 } d3019c1db87425 Antony Antony 2026-01-17 3279 if (attrs[XFRMA_OFFLOAD_DEV]) { d3019c1db87425 Antony Antony 2026-01-17 3280 xuo = kmemdup(nla_data(attrs[XFRMA_OFFLOAD_DEV]), d3019c1db87425 Antony Antony 2026-01-17 3281 sizeof(*xuo), GFP_KERNEL); d3019c1db87425 Antony Antony 2026-01-17 3282 if (!xuo) { d3019c1db87425 Antony Antony 2026-01-17 3283 err = -ENOMEM; d3019c1db87425 Antony Antony 2026-01-17 3284 goto error; d3019c1db87425 Antony Antony 2026-01-17 3285 } d3019c1db87425 Antony Antony 2026-01-17 3286 } d3019c1db87425 Antony Antony 2026-01-17 3287 xc = xfrm_state_migrate(x, &m, encap, net, xuo, extack); d3019c1db87425 Antony Antony 2026-01-17 3288 if (xc) { d3019c1db87425 Antony Antony 2026-01-17 3289 xfrm_state_delete(x); d3019c1db87425 Antony Antony 2026-01-17 3290 xfrm_send_migrate_state(um, encap, xuo); d3019c1db87425 Antony Antony 2026-01-17 3291 err = 0; d3019c1db87425 Antony Antony 2026-01-17 3292 } else { d3019c1db87425 Antony Antony 2026-01-17 3293 if (extack && !extack->_msg) d3019c1db87425 Antony Antony 2026-01-17 3294 NL_SET_ERR_MSG(extack, "State migration clone failed"); d3019c1db87425 Antony Antony 2026-01-17 3295 err = -EINVAL; d3019c1db87425 Antony Antony 2026-01-17 3296 } d3019c1db87425 Antony Antony 2026-01-17 3297 } else { d3019c1db87425 Antony Antony 2026-01-17 3298 NL_SET_ERR_MSG(extack, "Can not find state"); d3019c1db87425 Antony Antony 2026-01-17 @3299 return err; s/err/-ESRCH/. err is zero/success here. d3019c1db87425 Antony Antony 2026-01-17 3300 } d3019c1db87425 Antony Antony 2026-01-17 3301 error: d3019c1db87425 Antony Antony 2026-01-17 3302 xfrm_state_put(x); d3019c1db87425 Antony Antony 2026-01-17 3303 kfree(encap); d3019c1db87425 Antony Antony 2026-01-17 3304 kfree(xuo); d3019c1db87425 Antony Antony 2026-01-17 3305 return err; d3019c1db87425 Antony Antony 2026-01-17 3306 } -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki ^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [devel-ipsec] Re: [PATCH ipsec-next v2 4/4] xfrm: add XFRM_MSG_MIGRATE_STATE for single SA migration 2026-01-19 5:27 ` Dan Carpenter @ 2026-01-19 8:21 ` Antony Antony 2026-01-19 8:55 ` Dan Carpenter 0 siblings, 1 reply; 10+ messages in thread From: Antony Antony @ 2026-01-19 8:21 UTC (permalink / raw) To: Dan Carpenter Cc: oe-kbuild, Antony Antony, Steffen Klassert, Herbert Xu, netdev, lkp, oe-kbuild-all, David S . Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni, Chiachang Wang, Yan Yan, devel, Simon Horman, Paul Moore, Stephen Smalley, Ondrej Mosnacek, linux-kernel, selinux Hi Dan, On Mon, Jan 19, 2026 at 08:27:25AM +0300, Dan Carpenter via Devel wrote: > Hi Antony, > > kernel test robot noticed the following build warnings: > > https://git-scm.com/docs/git-format-patch#_base_tree_information] > > url: https://github.com/intel-lab-lkp/linux/commits/Antony-Antony/xfrm-remove-redundant-assignments/20260118-041031 > base: https://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next.git master > patch link: https://lore.kernel.org/r/951cb30ac3866c6075bc7359d0997dbffc3ce6da.1768679141.git.antony.antony%40secunet.com > patch subject: [PATCH ipsec-next v2 4/4] xfrm: add XFRM_MSG_MIGRATE_STATE for single SA migration > config: hexagon-randconfig-r072-20260118 (https://download.01.org/0day-ci/archive/20260119/202601190605.ZVkgcUYl-lkp@intel.com/config) > compiler: clang version 22.0.0git (https://github.com/llvm/llvm-project 9b8addffa70cee5b2acc5454712d9cf78ce45710) > smatch version: v0.5.0-8985-g2614ff1a > > If you fix the issue in a separate patch/commit (i.e. not just a new version of > the same patch/commit), kindly add following tags > | Reported-by: kernel test robot <lkp@intel.com> > | Reported-by: Dan Carpenter <dan.carpenter@linaro.org> > | Closes: https://lore.kernel.org/r/202601190605.ZVkgcUYl-lkp@intel.com/ > > New smatch warnings: > net/xfrm/xfrm_user.c:3299 xfrm_do_migrate_state() warn: missing error code? 'err' Looking at this more closely, xfrm_user_state_lookup() always sets *errp when it returns NULL. > Old smatch warnings: > net/xfrm/xfrm_user.c:1024 xfrm_add_sa() warn: missing error code? 'err' > net/xfrm/xfrm_user.c:2248 xfrm_add_policy() warn: missing error code? 'err' > net/xfrm/xfrm_user.c:3018 xfrm_add_acquire() warn: missing error code 'err' Also, as the "Old smatch warnings" show, this same pattern exists elsewhere in the file, most of the calls to xfrm_user_state_lookup(). I'm inclined to leave it as is rather than change a pattern that's consistent throughout the file. Does smatch follow the code doing cross-function analysis? In this case, look into xfrm_user_state_lookup() and further down to see that *errp is set when NULL is returned? Thanks -antony > vim +/err +3299 net/xfrm/xfrm_user.c > > d3019c1db87425 Antony Antony 2026-01-17 3240 static int xfrm_do_migrate_state(struct sk_buff *skb, struct nlmsghdr *nlh, > d3019c1db87425 Antony Antony 2026-01-17 3241 struct nlattr **attrs, struct netlink_ext_ack *extack) > d3019c1db87425 Antony Antony 2026-01-17 3242 { > d3019c1db87425 Antony Antony 2026-01-17 3243 int err = -ESRCH; > d3019c1db87425 Antony Antony 2026-01-17 3244 struct xfrm_state *x; > d3019c1db87425 Antony Antony 2026-01-17 3245 struct net *net = sock_net(skb->sk); > d3019c1db87425 Antony Antony 2026-01-17 3246 struct xfrm_encap_tmpl *encap = NULL; > d3019c1db87425 Antony Antony 2026-01-17 3247 struct xfrm_user_offload *xuo = NULL; > d3019c1db87425 Antony Antony 2026-01-17 3248 struct xfrm_migrate m = { .old_saddr.a4 = 0,}; > d3019c1db87425 Antony Antony 2026-01-17 3249 struct xfrm_user_migrate_state *um = nlmsg_data(nlh); > d3019c1db87425 Antony Antony 2026-01-17 3250 > d3019c1db87425 Antony Antony 2026-01-17 3251 if (!um->id.spi) { > d3019c1db87425 Antony Antony 2026-01-17 3252 NL_SET_ERR_MSG(extack, "Invalid SPI 0x0"); > d3019c1db87425 Antony Antony 2026-01-17 3253 return -EINVAL; > d3019c1db87425 Antony Antony 2026-01-17 3254 } > d3019c1db87425 Antony Antony 2026-01-17 3255 > d3019c1db87425 Antony Antony 2026-01-17 3256 err = copy_from_user_migrate_state(&m, um); > d3019c1db87425 Antony Antony 2026-01-17 3257 if (err) > d3019c1db87425 Antony Antony 2026-01-17 3258 return err; > d3019c1db87425 Antony Antony 2026-01-17 3259 > d3019c1db87425 Antony Antony 2026-01-17 3260 x = xfrm_user_state_lookup(net, &um->id, attrs, &err); > d3019c1db87425 Antony Antony 2026-01-17 3261 > d3019c1db87425 Antony Antony 2026-01-17 3262 if (x) { > d3019c1db87425 Antony Antony 2026-01-17 3263 struct xfrm_state *xc; > d3019c1db87425 Antony Antony 2026-01-17 3264 > d3019c1db87425 Antony Antony 2026-01-17 3265 if (!x->dir) { > d3019c1db87425 Antony Antony 2026-01-17 3266 NL_SET_ERR_MSG(extack, "State direction is invalid"); > d3019c1db87425 Antony Antony 2026-01-17 3267 err = -EINVAL; > d3019c1db87425 Antony Antony 2026-01-17 3268 goto error; > d3019c1db87425 Antony Antony 2026-01-17 3269 } > d3019c1db87425 Antony Antony 2026-01-17 3270 > d3019c1db87425 Antony Antony 2026-01-17 3271 if (attrs[XFRMA_ENCAP]) { > d3019c1db87425 Antony Antony 2026-01-17 3272 encap = kmemdup(nla_data(attrs[XFRMA_ENCAP]), > d3019c1db87425 Antony Antony 2026-01-17 3273 sizeof(*encap), GFP_KERNEL); > d3019c1db87425 Antony Antony 2026-01-17 3274 if (!encap) { > d3019c1db87425 Antony Antony 2026-01-17 3275 err = -ENOMEM; > d3019c1db87425 Antony Antony 2026-01-17 3276 goto error; > d3019c1db87425 Antony Antony 2026-01-17 3277 } > d3019c1db87425 Antony Antony 2026-01-17 3278 } > d3019c1db87425 Antony Antony 2026-01-17 3279 if (attrs[XFRMA_OFFLOAD_DEV]) { > d3019c1db87425 Antony Antony 2026-01-17 3280 xuo = kmemdup(nla_data(attrs[XFRMA_OFFLOAD_DEV]), > d3019c1db87425 Antony Antony 2026-01-17 3281 sizeof(*xuo), GFP_KERNEL); > d3019c1db87425 Antony Antony 2026-01-17 3282 if (!xuo) { > d3019c1db87425 Antony Antony 2026-01-17 3283 err = -ENOMEM; > d3019c1db87425 Antony Antony 2026-01-17 3284 goto error; > d3019c1db87425 Antony Antony 2026-01-17 3285 } > d3019c1db87425 Antony Antony 2026-01-17 3286 } > d3019c1db87425 Antony Antony 2026-01-17 3287 xc = xfrm_state_migrate(x, &m, encap, net, xuo, extack); > d3019c1db87425 Antony Antony 2026-01-17 3288 if (xc) { > d3019c1db87425 Antony Antony 2026-01-17 3289 xfrm_state_delete(x); > d3019c1db87425 Antony Antony 2026-01-17 3290 xfrm_send_migrate_state(um, encap, xuo); > d3019c1db87425 Antony Antony 2026-01-17 3291 err = 0; > d3019c1db87425 Antony Antony 2026-01-17 3292 } else { > d3019c1db87425 Antony Antony 2026-01-17 3293 if (extack && !extack->_msg) > d3019c1db87425 Antony Antony 2026-01-17 3294 NL_SET_ERR_MSG(extack, "State migration clone failed"); > d3019c1db87425 Antony Antony 2026-01-17 3295 err = -EINVAL; > d3019c1db87425 Antony Antony 2026-01-17 3296 } > d3019c1db87425 Antony Antony 2026-01-17 3297 } else { > d3019c1db87425 Antony Antony 2026-01-17 3298 NL_SET_ERR_MSG(extack, "Can not find state"); > d3019c1db87425 Antony Antony 2026-01-17 @3299 return err; > > s/err/-ESRCH/. err is zero/success here. > > d3019c1db87425 Antony Antony 2026-01-17 3300 } > d3019c1db87425 Antony Antony 2026-01-17 3301 error: > d3019c1db87425 Antony Antony 2026-01-17 3302 xfrm_state_put(x); > d3019c1db87425 Antony Antony 2026-01-17 3303 kfree(encap); > d3019c1db87425 Antony Antony 2026-01-17 3304 kfree(xuo); > d3019c1db87425 Antony Antony 2026-01-17 3305 return err; > d3019c1db87425 Antony Antony 2026-01-17 3306 } > > -- > 0-DAY CI Kernel Test Service > https://github.com/intel/lkp-tests/wiki > > -- > Devel mailing list -- devel@lists.linux-ipsec.org > To unsubscribe send an email to devel-leave@lists.linux-ipsec.org ^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [devel-ipsec] Re: [PATCH ipsec-next v2 4/4] xfrm: add XFRM_MSG_MIGRATE_STATE for single SA migration 2026-01-19 8:21 ` [devel-ipsec] " Antony Antony @ 2026-01-19 8:55 ` Dan Carpenter 0 siblings, 0 replies; 10+ messages in thread From: Dan Carpenter @ 2026-01-19 8:55 UTC (permalink / raw) To: Antony Antony Cc: oe-kbuild, Antony Antony, Steffen Klassert, Herbert Xu, netdev, lkp, oe-kbuild-all, David S . Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni, Chiachang Wang, Yan Yan, devel, Simon Horman, Paul Moore, Stephen Smalley, Ondrej Mosnacek, linux-kernel, selinux On Mon, Jan 19, 2026 at 09:21:51AM +0100, Antony Antony wrote: > Hi Dan, > > On Mon, Jan 19, 2026 at 08:27:25AM +0300, Dan Carpenter via Devel wrote: > > Hi Antony, > > > > kernel test robot noticed the following build warnings: > > > > https://git-scm.com/docs/git-format-patch#_base_tree_information] > > > > url: https://github.com/intel-lab-lkp/linux/commits/Antony-Antony/xfrm-remove-redundant-assignments/20260118-041031 > > base: https://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next.git master > > patch link: https://lore.kernel.org/r/951cb30ac3866c6075bc7359d0997dbffc3ce6da.1768679141.git.antony.antony%40secunet.com > > patch subject: [PATCH ipsec-next v2 4/4] xfrm: add XFRM_MSG_MIGRATE_STATE for single SA migration > > config: hexagon-randconfig-r072-20260118 (https://download.01.org/0day-ci/archive/20260119/202601190605.ZVkgcUYl-lkp@intel.com/config) > > compiler: clang version 22.0.0git (https://github.com/llvm/llvm-project 9b8addffa70cee5b2acc5454712d9cf78ce45710) > > smatch version: v0.5.0-8985-g2614ff1a > > > > If you fix the issue in a separate patch/commit (i.e. not just a new version of > > the same patch/commit), kindly add following tags > > | Reported-by: kernel test robot <lkp@intel.com> > > | Reported-by: Dan Carpenter <dan.carpenter@linaro.org> > > | Closes: https://lore.kernel.org/r/202601190605.ZVkgcUYl-lkp@intel.com/ > > > > New smatch warnings: > > net/xfrm/xfrm_user.c:3299 xfrm_do_migrate_state() warn: missing error code? 'err' > > Looking at this more closely, xfrm_user_state_lookup() always sets *errp > when it returns NULL. > > > Old smatch warnings: > > net/xfrm/xfrm_user.c:1024 xfrm_add_sa() warn: missing error code? 'err' > > net/xfrm/xfrm_user.c:2248 xfrm_add_policy() warn: missing error code? 'err' > > net/xfrm/xfrm_user.c:3018 xfrm_add_acquire() warn: missing error code 'err' > > Also, as the "Old smatch warnings" show, this same pattern exists elsewhere > in the file, most of the calls to xfrm_user_state_lookup(). > > I'm inclined to leave it as is rather than change a pattern that's > consistent throughout the file. Does smatch follow the code doing > cross-function analysis? In this case, look into xfrm_user_state_lookup() > and further down to see that *errp is set when NULL is returned? > Ah, right. Sorry about that. Yes, of course, it shouldn't be changed. The zero day bot can't do cross function analysis because it doesn't scale for the number of trees the bot tests... regards, dan carpenter ^ permalink raw reply [flat|nested] 10+ messages in thread
end of thread, other threads:[~2026-01-19 8:56 UTC | newest] Thread overview: 10+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2026-01-17 20:04 [PATCH ipsec-next v2 0/4] xfrm: XFRM_MSG_MIGRATE_STATE new netlink message Antony Antony 2026-01-17 19:58 ` [PATCH ipsec-next v2 1/4] xfrm: remove redundant assignments Antony Antony 2026-01-17 19:59 ` Antony Antony 2026-01-17 20:06 ` Antony Antony 2026-01-17 20:06 ` [PATCH ipsec-next v2 2/4] xfrm: allow migration from UDP encapsulated to non-encapsulated ESP Antony Antony 2026-01-17 20:07 ` [PATCH ipsec-next v2 3/4] xfrm: rename reqid in xfrm_migrate Antony Antony 2026-01-17 20:07 ` [PATCH ipsec-next v2 4/4] xfrm: add XFRM_MSG_MIGRATE_STATE for single SA migration Antony Antony 2026-01-19 5:27 ` Dan Carpenter 2026-01-19 8:21 ` [devel-ipsec] " Antony Antony 2026-01-19 8:55 ` Dan Carpenter
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox