From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DCA632820A9; Mon, 13 Apr 2026 16:06:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776096382; cv=none; b=F8xObeLO/6VdcqEIFn8qJN+LG3yDXyJxmKXAnFqPmJqOUhHexcZYbZ8jediw/1smOgf4bXSK5d1NQ6M4YUEv3tF5IOE378VZwgG6565/P2us8WE59VcxK1abud1VE6sRdQOZpnKdAv+XCm02smKM4hd7y/oz2xhixsMSrz1Ty+I= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776096382; c=relaxed/simple; bh=tKcJvuEfWBNa8EGwFpbJsdXeoeQStqikIit2WeCUYEM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=h5UP7uYx4ADGWNmdU4n/cKB1zZVVfMXqvwimUWBHGdjHPOWzNmx2IL5A+T1Sa1H6m7/DXslOf+rJClvU1tIcppYWr09CUWXA1xqHroD4kXMnFgU4YJEgDyTT+o6nOlJv58fNbP3KK8O5nSocf+7hJgL7BeWKw/46VJbSsKlYLK4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=JW5WDKxJ; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="JW5WDKxJ" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 73FAAC2BCAF; Mon, 13 Apr 2026 16:06:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1776096382; bh=tKcJvuEfWBNa8EGwFpbJsdXeoeQStqikIit2WeCUYEM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=JW5WDKxJ3/8vjUEplRNVOfwNzdZwgQs1YsK9HnSRocgHlYpFPwr13lhWA4n2zkfsO Ly+vpiAHvytjPi31UVe7r4tP2UYycYHNi9VAd2aJ355EVB0XpX0LvS6zdo522CLf9v Vz+xxtpPk1AigDH+0Htm9jwFnV2+Q32D6sh03R6Q= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Keenan Dong , David Howells , Marc Dionne , Simon Horman , Willy Tarreau , linux-afs@lists.infradead.org, stable@kernel.org, Jakub Kicinski Subject: [PATCH 6.19 77/86] rxrpc: fix oversized RESPONSE authenticator length check Date: Mon, 13 Apr 2026 18:00:24 +0200 Message-ID: <20260413155734.417289947@linuxfoundation.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260413155731.568515178@linuxfoundation.org> References: <20260413155731.568515178@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.19-stable review patch. If anyone has any objections, please let me know. ------------------ From: Keenan Dong commit a2567217ade970ecc458144b6be469bc015b23e5 upstream. rxgk_verify_response() decodes auth_len from the packet and is supposed to verify that it fits in the remaining bytes. The existing check is inverted, so oversized RESPONSE authenticators are accepted and passed to rxgk_decrypt_skb(), which can later reach skb_to_sgvec() with an impossible length and hit BUG_ON(len). Decoded from the original latest-net reproduction logs with scripts/decode_stacktrace.sh: RIP: __skb_to_sgvec() [net/core/skbuff.c:5285 (discriminator 1)] Call Trace: skb_to_sgvec() [net/core/skbuff.c:5305] rxgk_decrypt_skb() [net/rxrpc/rxgk_common.h:81] rxgk_verify_response() [net/rxrpc/rxgk.c:1268] rxrpc_process_connection() [net/rxrpc/conn_event.c:266 net/rxrpc/conn_event.c:364 net/rxrpc/conn_event.c:386] process_one_work() [kernel/workqueue.c:3281] worker_thread() [kernel/workqueue.c:3353 kernel/workqueue.c:3440] kthread() [kernel/kthread.c:436] ret_from_fork() [arch/x86/kernel/process.c:164] Reject authenticator lengths that exceed the remaining packet payload. Fixes: 9d1d2b59341f ("rxrpc: rxgk: Implement the yfs-rxgk security class (GSSAPI)") Signed-off-by: Keenan Dong Signed-off-by: David Howells cc: Marc Dionne cc: Simon Horman cc: Willy Tarreau cc: linux-afs@lists.infradead.org cc: stable@kernel.org Link: https://patch.msgid.link/20260408121252.2249051-14-dhowells@redhat.com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman --- net/rxrpc/rxgk.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/net/rxrpc/rxgk.c +++ b/net/rxrpc/rxgk.c @@ -1224,7 +1224,7 @@ static int rxgk_verify_response(struct r auth_offset = offset; auth_len = ntohl(xauth_len); - if (auth_len < len) + if (auth_len > len) goto short_packet; if (auth_len & 3) goto inconsistent;