From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 88923C433EF for ; Thu, 14 Apr 2022 10:37:31 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229881AbiDNKjy (ORCPT ); Thu, 14 Apr 2022 06:39:54 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45482 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229876AbiDNKjx (ORCPT ); Thu, 14 Apr 2022 06:39:53 -0400 Received: from wout1-smtp.messagingengine.com (wout1-smtp.messagingengine.com [64.147.123.24]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EE93C75219 for ; Thu, 14 Apr 2022 03:37:28 -0700 (PDT) Received: from compute4.internal (compute4.nyi.internal [10.202.2.44]) by mailout.west.internal (Postfix) with ESMTP id 82C5C3200E1A; Thu, 14 Apr 2022 06:37:27 -0400 (EDT) Received: from mailfrontend2 ([10.202.2.163]) by compute4.internal (MEProxy); Thu, 14 Apr 2022 06:37:28 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kroah.com; h=cc :cc:content-type:date:date:from:from:in-reply-to:in-reply-to :message-id:mime-version:references:reply-to:sender:subject :subject:to:to; s=fm1; t=1649932646; x=1650019046; bh=vTYhs0jR7B 8XW+1JEAKGyPbwD0+qjEkJywpMqVSKmTE=; b=OzlSxBDnw3j8j8VXGDQ7JPhrl7 AYAd8/RVylkpF9cp5kVeI2zfijuer8ccuMGD9CUwuTeA9YfCLjaZYQInQ3PbhZNI Qiz3mqDXTGNqjJz40CPx/HOi1wKx4vHiuXawawOQPgBCnPLYI+nzfEY2mHCrs1cd QNjz7cSkMvq1+NDssQsxTExdOtvWSuCarmDdtXBiEbZeyFGL6/o6p4jtqXtYCSbt zu06+dpOFo3YHC0xO921GzPNPs5cK+Q4z6I1QCtp2c2/nXljKgAU/QgleXJF+/M/ Ogs+R3u33082wwIHVi1eNNHbeVrI5mGXc4jro774eYMrYBm9kfnpGlZGj+xA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-type:date:date:from:from :in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:sender:subject:subject:to:to:x-me-proxy:x-me-proxy :x-me-sender:x-me-sender:x-sasl-enc; s=fm1; t=1649932646; x= 1650019046; bh=vTYhs0jR7B8XW+1JEAKGyPbwD0+qjEkJywpMqVSKmTE=; b=o EdGMyj6qCnf0HdwAe5VfaDHo+i8WK6p2peeZ8vignHyAU/csHLiTIQfwHwaRCfsV xIOZlyrs4tbHv2Bs64XIBF0HAKmpp1J8epoqwuJKU0xiYegsmhof28wujYZwK3MJ rN+xM5rXGFOgcBk6Z/3JSwrZOkl1DVqwZOqAX2Rim/ok5WonojpgcS6fRGzk+9x3 VpQ3br2NCIQ862ikIvz5E2s5+GKmX5p6aoYS4z6gKe69ahxBvbwrbLoYWCEG6l1h mCaclFAXqA2/D//LZZLiy88fR06gm2/Fq64nhClFKzZABBUW784ZrASEdw05w4cv neGwwJeMVaLlHifHVGlSQ== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedvvddrudelfedgvdelucetufdoteggodetrfdotf fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfqfgfvpdfurfetoffkrfgpnffqhgen uceurghilhhouhhtmecufedttdenucesvcftvggtihhpihgvnhhtshculddquddttddmne cujfgurhepfffhvffukfhfgggtuggjsehttdertddttddvnecuhfhrohhmpefirhgvghcu mffjuceoghhrvghgsehkrhhorghhrdgtohhmqeenucggtffrrghtthgvrhhnpeevueehje fgfffgiedvudekvdektdelleelgefhleejieeugeegveeuuddukedvteenucevlhhushht vghrufhiiigvpedunecurfgrrhgrmhepmhgrihhlfhhrohhmpehgrhgvgheskhhrohgrhh drtghomh X-ME-Proxy: Received: by mail.messagingengine.com (Postfix) with ESMTPA; Thu, 14 Apr 2022 06:37:25 -0400 (EDT) Date: Thu, 14 Apr 2022 12:37:14 +0200 From: Greg KH To: Tobias Brunner Cc: stable@vger.kernel.org, "David S. Miller" , Steffen Klassert , Xin Long Subject: Re: [PATCH 4.19] xfrm: policy: match with both mark and mask on user interfaces Message-ID: References: <9376197f-55d6-d450-4b51-a86aae21feb2@strongswan.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <9376197f-55d6-d450-4b51-a86aae21feb2@strongswan.org> Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org On Tue, Apr 12, 2022 at 09:33:58AM +0200, Tobias Brunner wrote: > From: Xin Long > > commit 4f47e8ab6ab796b5380f74866fa5287aca4dcc58 upstream. > > In commit ed17b8d377ea ("xfrm: fix a warning in xfrm_policy_insert_list"), > it would take 'priority' to make a policy unique, and allow duplicated > policies with different 'priority' to be added, which is not expected > by userland, as Tobias reported in strongswan. > > To fix this duplicated policies issue, and also fix the issue in > commit ed17b8d377ea ("xfrm: fix a warning in xfrm_policy_insert_list"), > when doing add/del/get/update on user interfaces, this patch is to change > to look up a policy with both mark and mask by doing: > > mark.v == pol->mark.v && mark.m == pol->mark.m > > and leave the check: > > (mark & pol->mark.m) == pol->mark.v > > for tx/rx path only. > > As the userland expects an exact mark and mask match to manage policies. > > v1->v2: > - make xfrm_policy_mark_match inline and fix the changelog as > Tobias suggested. > > Cc: # 4.19.x > Fixes: 295fae568885 ("xfrm: Allow user space manipulation of SPD mark") > Fixes: ed17b8d377ea ("xfrm: fix a warning in xfrm_policy_insert_list") > Reported-by: Tobias Brunner > Tested-by: Tobias Brunner > Signed-off-by: Xin Long > Signed-off-by: Steffen Klassert > --- > This is a backport to 4.19.x of a fix that has already been applied > to newer stable kernels. However, due to conflicts it was never > included in the 4.x trees, which all contain backports of the > problematic commit referenced above (ed17b8d377ea). So they all are > prone to creating duplicate IPsec policies with priority updates. All 3 now queued up, thanks. greg k-h