netdev - [bug report] xfrm: always fail xfrm_dev_{state,policy}_flush_secctx

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <aYXvliWTCzC9IIVS@stanley.mountain>
Date: Fri, 6 Feb 2026 16:41:42 +0300
From: Dan Carpenter <dan.carpenter@...aro.org>
To: Tetsuo Handa <penguin-kernel@...ove.sakura.ne.jp>
Cc: Simon Horman <horms@...nel.org>, netdev@...r.kernel.org,
	linux-kernel <linux-kernel@...r.kernel.org>
Subject: [bug report] xfrm: always fail
 xfrm_dev_{state,policy}_flush_secctx_check()

[ Smatch checking is paused while we raise funding.  #SadFace
  https://lore.kernel.org/all/aTaiGSbWZ9DJaGo7@stanley.mountain/ -dan ]

Hello Tetsuo Handa,

Commit 638361ad7ab2 ("xfrm: always fail
xfrm_dev_{state,policy}_flush_secctx_check()") from Feb 2, 2026
(linux-next), leads to the following Smatch static checker warning:

	net/xfrm/xfrm_state.c:898 xfrm_dev_state_flush_secctx_check()
	warn: was '== (-1)' instead of '='

net/xfrm/xfrm_state.c
    888         int i, err = 0;
    889 
    890         for (i = 0; i <= net->xfrm.state_hmask; i++) {
    891                 struct xfrm_state *x;
    892                 struct xfrm_dev_offload *xso;
    893 
    894                 hlist_for_each_entry(x, net->xfrm.state_bydst+i, bydst) {
    895                         xso = &x->xso;
    896 
    897                         if (xso->dev == dev &&
--> 898                             (err = -EPERM) != 0) {
                                         ^
= vs == bug.

    899                                 pr_info("%s: LSM policy is rejecting this operation.\n", __func__);
    900                                 dump_stack();
    901                                 xfrm_audit_state_delete(x, 0, task_valid);
    902                                 return err;
    903                         }
    904                 }
    905         }
    906 
    907         return err;
    908 }

regards,
dan carpenter