[PATCH net] macsec: check the resolved SCI for duplicates

[PATCH net] macsec: check the resolved SCI for duplicates

[Haseeb Malik via B4 Relay]

From: Haseeb Malik <haseebulhaq55@gmail.com>

An all-ones IFLA_MACSEC_SCI selects the default SCI derived from the
MACsec device's MAC address and port 1. macsec_init_secy() resolves this
value and stores the result in secy.sci, but macsec_newlink() checks for
duplicates using the unchanged local sci argument.

Consequently, an all-ones request can create a second MACsec device with
the same transmit SCI on the same lower device, while requesting that
SCI explicitly returns -EBUSY.

Check the initialized SecY's SCI so that duplicate detection uses the
value that the new device will actually use. Preserve the all-ones
fallback when the resulting SCI is available.

Add regression tests for duplicate rejection using default, explicit and
all-ones SCI requests, and for valid fallback and reuse after deletion.
The same tests reproduce two failures before the fix and pass afterward.

Fixes: c09440f7dcb3 ("macsec: introduce IEEE 802.1AE driver")
Link: https://lists.openwall.net/netdev/2026/09/16/11
Assisted-by: LLM
Signed-off-by: Haseeb Malik <haseebulhaq55@gmail.com>
---
Tested on arm64/virtme with KASAN and lockdep: the new regression
tests go from 5 pass/2 fail to 7 pass/0 fail. The full MACsec selftest
passes all 15 cases without skips.
---
 drivers/net/macsec.c                          |  2 +-
 tools/testing/selftests/drivers/net/macsec.py | 48 +++++++++++++++++++++++++++
 2 files changed, 49 insertions(+), 1 deletion(-)

diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
index 78a19b134632..7dabdac754f1 100644
--- a/drivers/net/macsec.c
+++ b/drivers/net/macsec.c
@@ -4254,7 +4254,7 @@ static int macsec_newlink(struct net_device *dev,
 	if (err < 0)
 		goto unregister;
 
-	if (rx_handler && sci_exists(real_dev, sci)) {
+	if (rx_handler && sci_exists(real_dev, macsec->secy.sci)) {
 		err = -EBUSY;
 		goto unlink;
 	}
diff --git a/tools/testing/selftests/drivers/net/macsec.py b/tools/testing/selftests/drivers/net/macsec.py
index 9a83d9542e04..72ee1c6e146e 100755
--- a/tools/testing/selftests/drivers/net/macsec.py
+++ b/tools/testing/selftests/drivers/net/macsec.py
@@ -263,6 +263,52 @@ def test_offload_state(cfg) -> None:
             "features should match first offload-on snapshot")
 
 
+@ksft_variants([
+    KsftNamedVariant("default", "", ""),
+    KsftNamedVariant("explicit", "", "sci {sci}"),
+    KsftNamedVariant("undefined", "", "sci ffffffffffffffff"),
+    KsftNamedVariant("undefined_default", "sci ffffffffffffffff", ""),
+    KsftNamedVariant("undefined_explicit", "sci ffffffffffffffff", "sci {sci}"),
+    KsftNamedVariant("undefined_twice", "sci ffffffffffffffff",
+                     "sci ffffffffffffffff"),
+])
+def test_duplicate_sci(cfg, first, second) -> None:
+    """Reject duplicate transmit SCIs, including the undefined-SCI fallback."""
+
+    ms0 = _macsec_name(0)
+    ms1 = _macsec_name(1)
+    sci = _get_mac(cfg.ifname).replace(":", "") + "0001"
+
+    ip(f"link add link {cfg.ifname} {ms0} type macsec {first}")
+    defer(ip, f"link del {ms0}")
+    with ksft_raises(CmdExitFailure):
+        ip(f"link add link {cfg.ifname} {ms1} type macsec "
+           f"{second.format(sci=sci)}")
+        # Clean up if the kernel incorrectly accepted the duplicate.
+        defer(ip, f"link del {ms1}")
+
+
+def test_undefined_sci(cfg) -> None:
+    """An undefined SCI still selects the default when it is available."""
+
+    ms0 = _macsec_name(0)
+    ms1 = _macsec_name(1)
+    sci = _get_mac(cfg.ifname).replace(":", "") + "0001"
+
+    # A different port on the same lower device must not block the fallback.
+    ip(f"link add link {cfg.ifname} {ms0} type macsec port 2")
+    defer(ip, f"link del {ms0}")
+    ip(f"link add link {cfg.ifname} {ms1} type macsec sci ffffffffffffffff")
+    cleanup = defer(ip, f"link del {ms1}")
+    info = ip(f"-d link show dev {ms1}", json=True)[0]
+    ksft_eq(info["linkinfo"]["info_data"]["sci"], sci)
+
+    # Deleting a device must make its SCI available again.
+    cleanup.exec()
+    ip(f"link add link {cfg.ifname} {ms1} type macsec sci ffffffffffffffff")
+    defer(ip, f"link del {ms1}")
+
+
 def _check_nsim_vid(cfg, vid, expected) -> None:
     """Checks if a VLAN is present. Only works on netdevsim."""
 
@@ -333,6 +379,8 @@ def main() -> None:
                   test_max_secy,
                   test_max_sc,
                   test_offload_state,
+                  test_duplicate_sci,
+                  test_undefined_sci,
                   test_vlan,
                   test_vlan_toggle,
                   ], args=(cfg,))

---
base-commit: 11536ee3d3e0b1bd35b6f3f8df55a6053eb0c71d
change-id: 20260926-fix-macsec-duplicate-sci-ed7635ac1c35

Best regards,
-- 
Haseeb Malik <haseebulhaq55@gmail.com>

Re: [PATCH net] macsec: check the resolved SCI for duplicates

[netdev-bot+sashiko]

Thank you for your contribution! Sashiko AI review found 1 potential
issue(s) to consider.

Critical: 0 · High: 0 · Medium: 1 · Low: 0

If you believe none of the issues are legitimate, please reply to each
issue of Medium severity or higher and explain why the AI is wrong.
If any of them are legitimate and you plan to respin, please let patchwork
know by including "pw-bot: cr" as a separate line at the end of your reply
(one such reply per series is enough).

- [Medium] The two new tests, test_duplicate_sci() and
  test_undefined_sci() in tools/testing/selftests/drivers/net/macsec.py,…

--

macsec: check the resolved SCI for duplicates

macsec_newlink() now passes macsec->secy.sci to sci_exists() when checking
for duplicates, instead of the unresolved local sci. Before this change, an
all-ones IFLA_MACSEC_SCI request could create a second MACsec device with
the same transmit SCI on the same lower device. The commit also adds
selftests for duplicate rejection and for the all-ones fallback.

Link: https://lists.openwall.net/netdev/2026/09/16/11

> diff --git a/tools/testing/selftests/drivers/net/macsec.py b/tools/testing/selftests/drivers/net/macsec.py
> index 9a83d9542e04a..72ee1c6e146ee 100755
> --- a/tools/testing/selftests/drivers/net/macsec.py
> +++ b/tools/testing/selftests/drivers/net/macsec.py
> @@ -263,6 +263,52 @@ def test_offload_state(cfg) -> None:
>              "features should match first offload-on snapshot")
>  
>  
> +@ksft_variants([
> +    KsftNamedVariant("default", "", ""),
> +    KsftNamedVariant("explicit", "", "sci {sci}"),
> +    KsftNamedVariant("undefined", "", "sci ffffffffffffffff"),
> +    KsftNamedVariant("undefined_default", "sci ffffffffffffffff", ""),
> +    KsftNamedVariant("undefined_explicit", "sci ffffffffffffffff", "sci {sci}"),
> +    KsftNamedVariant("undefined_twice", "sci ffffffffffffffff",
> +                     "sci ffffffffffffffff"),
> +])
> +def test_duplicate_sci(cfg, first, second) -> None:
> +    """Reject duplicate transmit SCIs, including the undefined-SCI fallback."""
> +
> +    ms0 = _macsec_name(0)
> +    ms1 = _macsec_name(1)
> +    sci = _get_mac(cfg.ifname).replace(":", "") + "0001"
> +
> +    ip(f"link add link {cfg.ifname} {ms0} type macsec {first}")

[Severity: Medium]
Should test_duplicate_sci() and test_undefined_sci() check that the local
iproute2 supports MACsec before they create links?

Every other test in this file calls a _require_* helper first:

  test_offload_api, test_offload_state -> _require_macsec_offload(cfg)
  test_max_secy, test_max_sc           -> _require_ip_macsec_offload()
  test_vlan, test_vlan_toggle          -> _require_ip_macsec(cfg)

Each of these helpers raises KsftSkipEx when "ip macsec help" shows that
support is missing.

In test_duplicate_sci(), this first ip link add runs outside ksft_raises().
With an iproute2 that lacks MACsec, it raises CmdExitFailure and the case
is reported as a failure instead of a skip.

test_undefined_sci() has the same problem:

    ip(f"link add link {cfg.ifname} {ms0} type macsec port 2")
    ...
    info = ip(f"-d link show dev {ms1}", json=True)[0]
    ksft_eq(info["linkinfo"]["info_data"]["sci"], sci)

If info_data is not in the JSON output, indexing it directly raises
KeyError, which also counts as a failure.

In that environment, all seven new cases (the six test_duplicate_sci
variants plus test_undefined_sci) would FAIL, while the rest of the file
would SKIP.

Both tests use only the local host. Would a local-only check be enough
here, such as _require_ip_macsec_offload() or a local variant of
_require_ip_macsec()? The existing _require_ip_macsec(cfg) also checks
cfg.remote, which these tests don't use.

> +    defer(ip, f"link del {ms0}")
> +    with ksft_raises(CmdExitFailure):
> +        ip(f"link add link {cfg.ifname} {ms1} type macsec "
> +           f"{second.format(sci=sci)}")
> +        # Clean up if the kernel incorrectly accepted the duplicate.
> +        defer(ip, f"link del {ms1}")

[ ... ]

-- 
Sashiko AI review · https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260927-fix-macsec-duplicate-sci-v1-1-085bd742c8e9%40gmail.com