From 6362f459bfc485d805f0439ae4566c1b014abfa4 Mon Sep 17 00:00:00 2001 From: Antony Antony Date: Wed, 7 Oct 2026 11:35:09 +0200 Subject: xfrm: state: exact mark/mask match for SPI-keyed control-plane SA lookups Add __xfrm_state_lookup_exact(); wire it into DELSA/GETSA, GETAE/NEWAE, EXPIRE, MIGRATE_STATE. xfrm_state_update() (UPDSA) keeps wildcard match because ALLOCSPI's larval state may be unmarked (mark 0/0), so an exact-match UPDSA would not find it and the ADD fallback would then fail with -EEXIST via xfrm_state_add(). Fixes: 3d6acfa7641f ("xfrm: SA lookups with mark") Signed-off-by: Antony Antony Signed-off-by: Steffen Klassert --- include/net/xfrm.h | 3 +++ 1 file changed, 3 insertions(+) (limited to 'include') diff --git a/include/net/xfrm.h b/include/net/xfrm.h index a6d69aaa6cd2..9e053388aa4b 100644 --- a/include/net/xfrm.h +++ b/include/net/xfrm.h @@ -1748,6 +1748,9 @@ struct xfrm_state *xfrm_state_lookup_byaddr(struct net *net, u32 mark, const xfrm_address_t *saddr, u8 proto, unsigned short family); +struct xfrm_state *xfrm_state_lookup_exact(struct net *net, const struct xfrm_mark *mark, + const xfrm_address_t *daddr, __be32 spi, + u8 proto, unsigned short family); #ifdef CONFIG_XFRM_SUB_POLICY void xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n, unsigned short family); -- cgit v1.2.3