From: Simon Horman <horms@kernel.org>
To: Weiming Shi <bestswngs@gmail.com>
Cc: David Howells <dhowells@redhat.com>,
Marc Dionne <marc.dionne@auristor.com>,
"David S . Miller" <davem@davemloft.net>,
Eric Dumazet <edumazet@google.com>,
Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>,
linux-afs@lists.infradead.org, netdev@vger.kernel.org,
linux-kernel@vger.kernel.org, Xiang Mei <xmei5@asu.edu>,
stable@vger.kernel.org, co+c09f7e87f6209a56@bugs.sh
Subject: Re: [PATCH net] rxrpc: rxgk: Initialize challenge control message
Date: Mon, 21 Sep 2026 15:23:05 +0100 [thread overview]
Message-ID: <20260921142305.GT13925@horms.kernel.org> (raw)
In-Reply-To: <20260918145705.1511737-3-bestswngs@gmail.com>
On Fri, Sep 18, 2026 at 10:57:07PM +0800, Weiming Shi wrote:
> rxgk_challenge_to_recvmsg() copies the complete rxgk_challenge structure
> into an RXRPC_CHALLENGED control message. The pad member of the embedded
> rxrpc_challenge is not assigned, so the copy can disclose one byte of
> kernel stack memory to userspace.
>
> Initialize the whole structure before filling its meaningful fields so
> that the reserved byte is always zero.
>
> Cc: stable@vger.kernel.org
> Fixes: 9d1d2b59341f ("rxrpc: rxgk: Implement the yfs-rxgk security class (GSSAPI)")
> Reported-by: <co+c09f7e87f6209a56@bugs.sh>
> Assisted-by: LLM
> Signed-off-by: Weiming Shi <bestswngs@gmail.com>
Reviewed-by: Simon Horman <horms@kernel.org>
...
prev parent reply other threads:[~2026-09-21 14:23 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-18 14:57 [PATCH net] rxrpc: rxgk: Initialize challenge control message Weiming Shi
2026-09-21 14:23 ` Simon Horman [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260921142305.GT13925@horms.kernel.org \
--to=horms@kernel.org \
--cc=bestswngs@gmail.com \
--cc=co+c09f7e87f6209a56@bugs.sh \
--cc=davem@davemloft.net \
--cc=dhowells@redhat.com \
--cc=edumazet@google.com \
--cc=kuba@kernel.org \
--cc=linux-afs@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=marc.dionne@auristor.com \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=stable@vger.kernel.org \
--cc=xmei5@asu.edu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.