CVE-2025-38590: net/mlx5e: Remove skb secpath if xfrm state is not found

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: Remove skb secpath if xfrm state is not found

Hardware returns a unique identifier for a decrypted packet's xfrm state, this state is looked up in an xarray. However, the state might have been freed by the time of this lookup.

Currently, if the state is not found, only a counter is incremented. The secpath (sp) extension on the skb is not removed, resulting in sp->len becoming 0.

Subsequently, functions like xfrmpolicycheck() attempt to access fields such as xfrminputstate(skb)->xso.type (which dereferences sp->xvec[sp->len - 1]) without first validating sp->len. This leads to a crash when dereferencing an invalid state pointer.

This patch prevents the crash by explicitly removing the secpath extension from the skb if the xfrm state is not found after hardware decryption. This ensures downstream functions do not operate on a zero-length secpath.

BUG: unable to handle page fault for address: ffffffff000002c8 #PF: supervisor read access in kernel mode #PF: errorcode(0x0000) - not-present page PGD 282e067 P4D 282e067 PUD 0 Oops: Oops: 0000 [#1] SMP CPU: 12 UID: 0 PID: 0 Comm: swapper/12 Not tainted 6.15.0-rc7forupstreammindebug202505272244 #1 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:xfrmpolicycheck+0x61a/0xa30 Code: b6 77 7f 83 e6 02 74 14 4d 8b af d8 00 00 00 41 0f b6 45 05 c1 e0 03 48 98 49 01 c5 41 8b 45 00 83 e8 01 48 98 49 8b 44 c5 10 <0f> b6 80 c8 02 00 00 83 e0 0c 3c 04 0f 84 0c 02 00 00 31 ff 80 fa RSP: 0018:ffff88885fb04918 EFLAGS: 00010297 RAX: ffffffff00000000 RBX: 0000000000000002 RCX: 0000000000000000 RDX: 0000000000000002 RSI: 0000000000000002 RDI: 0000000000000000 RBP: ffffffff8311af80 R08: 0000000000000020 R09: 00000000c2eda353 R10: ffff88812be2bbc8 R11: 000000001faab533 R12: ffff88885fb049c8 R13: ffff88812be2bbc8 R14: 0000000000000000 R15: ffff88811896ae00 FS: 0000000000000000(0000) GS:ffff8888dca82000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffff000002c8 CR3: 0000000243050002 CR4: 0000000000372eb0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <IRQ> ? trytowakeup+0x108/0x4c0 ? udp4liblookup2+0xbe/0x150 ? udpliblportinuse+0x100/0x100 ? udp4liblookup+0x2b0/0x410 xfrmpolicycheck2.constprop.0+0x11e/0x130 udpqueuercvoneskb+0x1d/0x530 udpunicastrcvskb+0x76/0x90 udp4librcv+0xa64/0xe90 ipprotocoldeliverrcu+0x20/0x130 iplocaldeliverfinish+0x75/0xa0 iplocaldeliver+0xc1/0xd0 ? ipprotocoldeliverrcu+0x130/0x130 ipsublistrcv+0x1f9/0x240 ? iprcvfinishcore+0x430/0x430 iplistrcv+0xfc/0x130 netifreceiveskblistcore+0x181/0x1e0 netifreceiveskblistinternal+0x200/0x360 ? mlx5ebuildrxskb+0x1bc/0xda0 [mlx5core] groreceiveskb+0xfd/0x210 mlx5ehandlerxcqempwrq+0x141/0x280 [mlx5core] mlx5epollrxcq+0xcc/0x8e0 [mlx5core] ? mlx5ehandlerxdim+0x91/0xd0 [mlx5core] mlx5enapipoll+0x114/0xab0 [mlx5core] napipoll+0x25/0x170 netrxaction+0x32d/0x3a0 ? mlx5eqcompint+0x8d/0x280 [mlx5core] ? notifiercallchain+0x33/0xa0 handlesoftirqs+0xda/0x250 irqexitrcu+0x6d/0xc0 commoninterrupt+0x81/0xa0 </IRQ>