linux-kernel - xfrm regression in 5.10.94

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <874b6461-07a7-1eeb-4e97-54d1be1c27fe@linux.microsoft.com>
Date:   Mon, 14 Feb 2022 11:59:56 +0100
From:   Kai Lüke <kailueke@...ux.microsoft.com>
To:     linux-kernel@...r.kernel.org
Subject: xfrm regression in 5.10.94

Hi,

in 5.10.94 these two xfrm changes cause userspace programs like Cilium to
suddenly fail (https://github.com/cilium/cilium/pull/18789):
- xfrm: interface with if_id 0 should return error
  8dce43919566f06e865f7e8949f5c10d8c2493f5
- xfrm: state and policy should fail if XFRMA_IF_ID 0
  68ac0f3810e76a853b5f7b90601a05c3048b8b54

I see that these changes are a reaction to
- xfrm: fix disable_xfrm sysctl when used on xfrm interfaces
  9f8550e4bd9d
but even if the "wrong" usage caused weired behavior I still wonder if it
was the right decision to do the changes as part of a bugfix update for an
LTS kernel.
What do you think about reverting the changes at least for 5.10?

Regards,
Kai