Re: [PATCH ipsec] xfrm: Pass template address family to xfrm_state_look_at

On Tue, Nov 3, 2020 at 4:05 AM Herbert Xu [off-list ref] wrote:

On Mon, Nov 02, 2020 at 06:32:19PM -0800, Anthony DeRossi wrote:

quoted

This fixes a regression where valid selectors are incorrectly skipped
when xfrm_state_find is called with a non-matching address family (e.g.
when using IPv6-in-IPv4 ESP in transport mode).

The state's address family is matched against the template's family
(encap_family) in xfrm_state_find before checking the selector in
xfrm_state_look_at.  The template's family should also be used for
selector matching, otherwise valid selectors may be skipped.

Fixes: e94ee171349d ("xfrm: Use correct address family in xfrm_state_find")
Signed-off-by: Anthony DeRossi <redacted>
---
 net/xfrm/xfrm_state.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

Your patch reintroduces the same bug that my patch was trying to
fix, namely that when you do the comparison on flow you must use
the original family and not some other value.

My mistake, I misunderstood the original bug.

Anthony