[PATCH net-next] macsec: check for duplicate SCIs before registering the device

[PATCH net-next] macsec: check for duplicate SCIs before registering the device

[Haseeb Malik via B4 Relay]

From: Haseeb Malik <haseebulhaq55@gmail.com>

macsec_newlink() registers and links the device before rejecting a
duplicate SCI. Registration can emit link notifications for a device
whose creation ultimately fails with -EBUSY.

The SCI is already resolved before SecY initialization, so check for a
duplicate there and return -EBUSY directly. Remove the now-unused unlink
label while preserving cleanup for failures after registration.

Suggested-by: Sabrina Dubroca <sd@queasysnail.net>
Link: https://lore.kernel.org/netdev/ar2KmwhtCMbOKLsG@krikkit/
Assisted-by: LLM
Signed-off-by: Haseeb Malik <haseebulhaq55@gmail.com>
---
Tested on arm64 in virtme with KASAN and lockdep: all 15 MACsec selftests
and 80 offload/cleanup cycles pass. Rejected-device link notifications
observed by the diagnostic drop from two to zero.

 drivers/net/macsec.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
index 409fd855235ba29125e39bfd80e1c5656aea784f..4e3020586b1e53c5a17f7e31c1f15b87f6443e17 100644
--- a/drivers/net/macsec.c
+++ b/drivers/net/macsec.c
@@ -4264,6 +4264,9 @@ static int macsec_newlink(struct net_device *dev,
 	if (sci == MACSEC_UNDEF_SCI)
 		sci = dev_to_sci(dev, MACSEC_PORT_ES);
 
+	if (rx_handler && sci_exists(real_dev, sci))
+		return -EBUSY;
+
 	/* Registration can notify listeners before returning. */
 	macsec_init_secy(dev, sci, icv_len);
 	if (data) {
@@ -4284,11 +4287,6 @@ static int macsec_newlink(struct net_device *dev,
 	if (err < 0)
 		goto unregister;
 
-	if (rx_handler && sci_exists(real_dev, sci)) {
-		err = -EBUSY;
-		goto unlink;
-	}
-
 	/* If h/w offloading is available, propagate to the device */
 	if (macsec_is_offloaded(macsec)) {
 		const struct macsec_ops *ops;
@@ -4320,7 +4318,6 @@ static int macsec_newlink(struct net_device *dev,
 
 del_dev:
 	macsec_del_dev(macsec);
-unlink:
 	netdev_upper_dev_unlink(real_dev, dev);
 unregister:
 	unregister_netdevice(dev);

base-commit: 8df0638138d3e0344fd1fb36cf2d1ca1cf5028f0

Re: [PATCH net-next] macsec: check for duplicate SCIs before registering the device

[Sabrina Dubroca]

2026-10-11, 21:57:11 +0000, Haseeb Malik via B4 Relay wrote:
> From: Haseeb Malik <haseebulhaq55@gmail.com>
> 
> macsec_newlink() registers and links the device before rejecting a
> duplicate SCI. Registration can emit link notifications for a device
> whose creation ultimately fails with -EBUSY.
> 
> The SCI is already resolved before SecY initialization, so check for a
> duplicate there and return -EBUSY directly. Remove the now-unused unlink
> label while preserving cleanup for failures after registration.
> 
> Suggested-by: Sabrina Dubroca <sd@queasysnail.net>
> Link: https://lore.kernel.org/netdev/ar2KmwhtCMbOKLsG@krikkit/
> Assisted-by: LLM
> Signed-off-by: Haseeb Malik <haseebulhaq55@gmail.com>
> ---
> Tested on arm64 in virtme with KASAN and lockdep: all 15 MACsec selftests
> and 80 offload/cleanup cycles pass. Rejected-device link notifications
> observed by the diagnostic drop from two to zero.

Thanks.

Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>

Sashiko is probably going to complain again about the mdo_add_secy
cleanup problem it caught in
https://lore.kernel.org/all/178951752525.22033.8547704610100726932@kernel.org/

If you have the time and interest to look at this, it would be
nice. If not, no worries, I'll take care of it later.

-- 
Sabrina