From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx1.secunet.com (mx1.secunet.com [62.96.220.36]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B3369345CCA; Tue, 27 Jan 2026 10:51:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=62.96.220.36 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1769511066; cv=none; b=CYIjLfqihGc0ql0HBquq1l32bvPDXaLz00z3criDBsGhM+4yhfD3Lw8t+tOGbi7iuhm8WxABmhVo52bnJ+mzyP32PI+UewmYvTpICu7dSi1KbggDXPuq/JHDkjhsIgOLqAMppZmPE+yTnwqMKkwL0BVfBPErm6zQ1yzdXJ/btco= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1769511066; c=relaxed/simple; bh=utdqw2dzorwQ1Pd3xTPpbB/2s1uOsEJnPq7287kcj2c=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=pYQ2vefuAR3st2+BE/3LMik1QiN+NlXBFoUY6UnkxEa4mWV1uPe4m1huO7BcP2ySE7bP221N9VdtNSuWG0EaGhYE0MGL2ci8mvdzFNf4Zr/ESz5Xc5qfsVFf+aHVmZOjgqzKw/6phlRt37buP4Gu2OROqWttMPJ9o6AoS+cEHxs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=secunet.com; spf=pass smtp.mailfrom=secunet.com; dkim=pass (2048-bit key) header.d=secunet.com header.i=@secunet.com header.b=f3ddqE84; arc=none smtp.client-ip=62.96.220.36 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=secunet.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=secunet.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=secunet.com header.i=@secunet.com header.b="f3ddqE84" Received: from localhost (localhost [127.0.0.1]) by mx1.secunet.com (Postfix) with ESMTP id E14C220748; Tue, 27 Jan 2026 11:51:02 +0100 (CET) X-Virus-Scanned: by secunet Received: from mx1.secunet.com ([127.0.0.1]) by localhost (mx1.secunet.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iuAHjnmj7Rwf; Tue, 27 Jan 2026 11:51:02 +0100 (CET) Received: from EXCH-02.secunet.de (rl2.secunet.de [10.32.0.232]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.secunet.com (Postfix) with ESMTPS id 3C41920728; Tue, 27 Jan 2026 11:51:02 +0100 (CET) DKIM-Filter: OpenDKIM Filter v2.11.0 mx1.secunet.com 3C41920728 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=secunet.com; s=202301; t=1769511062; bh=g7mhwZax9juLTOQ4px9tFJwZQFWYpekidbQ7V1UgCMI=; h=From:To:CC:Subject:Date:In-Reply-To:References:From; b=f3ddqE842MoFqn6/Mkyfa0Yq/4cZEsouEytASu+clJfDjnxxWxrJu5JsvRwM9I4z2 H3Ti5hAo461SS+aLfn91b9LJtilryNiP9jEA/CFDx+5tnMJPNRJi37YuJ4MVCEc/5M +ml427wCAAf8MXod27GwJbj0jWFMFRcUDShbFiWggM0w1MZcRhyVhAHN0paOQk8Hff ugjB7ZohNHEo26rhb+c2KWBWP8uDqjKqZTW6HT+uXL4pfynk8dkzgzf0jca+ob/EL+ sctPLljXXlhqws41N1TNoLVbd3CbCV4Gwn7AAiSZDXraRcreILo+i8ob3SvvbiN3+x PQJw6fidHMAcg== Received: from moon.secunet.de (172.18.149.1) by EXCH-02.secunet.de (10.32.0.172) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.17; Tue, 27 Jan 2026 11:51:01 +0100 From: Antony Antony To: Antony Antony , Steffen Klassert , Herbert Xu , CC: "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Chiachang Wang , Yan Yan , , Simon Horman , Subject: [PATCH ipsec-next v5 6/8] xfrm: add state synchronization after migration Date: Tue, 27 Jan 2026 11:50:46 +0100 Message-ID: <58f43c2cf105ed9ab4ac6807c8bcdbe2764f13c3.1769509131.git.antony.antony@secunet.com> X-Mailer: git-send-email 2.39.5 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain X-ClientProxiedBy: EXCH-03.secunet.de (10.32.0.183) To EXCH-02.secunet.de (10.32.0.172) Add xfrm_migrate_sync() to synchronize curlft and replay state after state installation, this can be called under lock without memory allocation. In preparation for a subsequent patch in this series. This ensures the migrated state captures the latest lifetime counters and replay state from the original after installation completes. Within the same lock, the original xfrm state is deleted. No functional change. Signed-off-by: Antony Antony --- v4->v5: - added this patch --- include/net/xfrm.h | 46 ++++++++++++++++++++++++++++++++++--------- net/xfrm/xfrm_state.c | 11 ++++------- 2 files changed, 41 insertions(+), 16 deletions(-) diff --git a/include/net/xfrm.h b/include/net/xfrm.h index a920d64d8cfa..6064ea0a6f2b 100644 --- a/include/net/xfrm.h +++ b/include/net/xfrm.h @@ -2024,23 +2024,51 @@ static inline unsigned int xfrm_replay_state_esn_len(struct xfrm_replay_state_es #ifdef CONFIG_XFRM_MIGRATE static inline int xfrm_replay_clone(struct xfrm_state *x, - struct xfrm_state *orig) + const struct xfrm_state *orig) { + /* Counters synced later in xfrm_replay_sync() */ - x->replay_esn = kmemdup(orig->replay_esn, + x->replay = orig->replay; + x->preplay = orig->preplay; + + if (orig->replay_esn) { + x->replay_esn = kmemdup(orig->replay_esn, xfrm_replay_state_esn_len(orig->replay_esn), GFP_KERNEL); - if (!x->replay_esn) - return -ENOMEM; - x->preplay_esn = kmemdup(orig->preplay_esn, - xfrm_replay_state_esn_len(orig->preplay_esn), - GFP_KERNEL); - if (!x->preplay_esn) - return -ENOMEM; + if (!x->replay_esn) + return -ENOMEM; + x->preplay_esn = kmemdup(orig->preplay_esn, + xfrm_replay_state_esn_len(orig->preplay_esn), + GFP_KERNEL); + if (!x->preplay_esn) + return -ENOMEM; + } return 0; } +static inline void xfrm_replay_sync(struct xfrm_state *x, const struct xfrm_state *orig) +{ + x->replay = orig->replay; + x->preplay = orig->preplay; + + if (orig->replay_esn) { + memcpy(x->replay_esn, orig->replay_esn, + xfrm_replay_state_esn_len(orig->replay_esn)); + + memcpy(x->preplay_esn, orig->preplay_esn, + xfrm_replay_state_esn_len(orig->preplay_esn)); + } +} + +static inline void xfrm_migrate_sync(struct xfrm_state *x, + const struct xfrm_state *orig) +{ + /* called under lock so no race conditions or mallocs allowed */ + memcpy(&x->curlft, &orig->curlft, sizeof(x->curlft)); + xfrm_replay_sync(x, orig); +} + static inline struct xfrm_algo_aead *xfrm_algo_aead_clone(struct xfrm_algo_aead *orig) { return kmemdup(orig, aead_len(orig), GFP_KERNEL); diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c index 35c82926665a..88a362e46972 100644 --- a/net/xfrm/xfrm_state.c +++ b/net/xfrm/xfrm_state.c @@ -2025,10 +2025,8 @@ static struct xfrm_state *xfrm_state_clone_and_setup(struct xfrm_state *orig, goto error; } - if (orig->replay_esn) { - if (xfrm_replay_clone(x, orig)) - goto error; - } + if (xfrm_replay_clone(x, orig)) + goto error; memcpy(&x->mark, &orig->mark, sizeof(x->mark)); memcpy(&x->props.smark, &orig->props.smark, sizeof(x->props.smark)); @@ -2041,11 +2039,8 @@ static struct xfrm_state *xfrm_state_clone_and_setup(struct xfrm_state *orig, x->tfcpad = orig->tfcpad; x->replay_maxdiff = orig->replay_maxdiff; x->replay_maxage = orig->replay_maxage; - memcpy(&x->curlft, &orig->curlft, sizeof(x->curlft)); x->km.state = orig->km.state; x->km.seq = orig->km.seq; - x->replay = orig->replay; - x->preplay = orig->preplay; x->mapping_maxage = orig->mapping_maxage; x->lastused = orig->lastused; x->new_mapping = 0; @@ -2194,6 +2189,8 @@ struct xfrm_state *xfrm_state_migrate(struct xfrm_state *x, if (xfrm_state_migrate_install(x, xc, m, xuo, extack) < 0) return NULL; + xfrm_migrate_sync(xc, x); + return xc; } EXPORT_SYMBOL(xfrm_state_migrate); -- 2.39.5