From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 786453909A2 for ; Mon, 13 Apr 2026 22:27:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776119236; cv=none; b=pD7e/uR8KnWgWx9mo1ONilDPFq9UCeFyQb7R7fDOZ5CiqVLkv1TJjtnjJRsI1iH2hAq2K1prnQkZy5ns3SO/bbVDZNybOq/Ug8wQVGS2tVsLtCEG385Zgm5VtH+y347exa9RCaPb0PPeYDMEUkrwdNHlzqZLfsrpwMIQlykDQZE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776119236; c=relaxed/simple; bh=hQ+9e9r12Nnfkh2D2znmJoSgBiw8/ohOw+QiE8NO9yI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=DHjvEuWKr2qncsECSbIg4pkYl3g3Feppy4Y5/T+Q5TWj7i6TTm63O5s4TWVxvE3MGpB2+qJOCWgifr+g2gjL6PNYzTCeb6et1hIQlAZWTuzc4yBK7bDlemi0TdNJj2SAU9nfoSE3kta9NE/7BNFSe4NCbe+EHSRRU6fmd5HqB3Y= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=d+WrHZiw; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="d+WrHZiw" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0C5D3C2BCAF; Mon, 13 Apr 2026 22:27:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1776119235; bh=hQ+9e9r12Nnfkh2D2znmJoSgBiw8/ohOw+QiE8NO9yI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=d+WrHZiwVvX38MVDQcJvekhJwLpyOyhkprucgd2gQClkPWRJNVk9OpOOoUKo39U0/ 4XFt4IayUljMcnOIABYXJzuF/ntIjXwcnOXId4WleVbhP60qClOz3B8LpCUQmEWOdQ IgMV98vlSIMqZMm0YJ1nwSk/B9fwncw1E58Q5R/Wx9vEU6l0/R+QHGu7seO+UJRoha iW23YJaufqQJP7kMV68x7k8C7tTsqlH3AwkWomvG75gYQ9kE2wUHIu8rbsB1wiJ+Yd 1Aaa8yyzMqAiNf6MEN7v6/3ZFdOf4pBQfWOfbGJAQJXAB4ZwjUGR3ddfsrhES2QT1R h+4SXB1HWvNvQ== From: Sasha Levin To: stable@vger.kernel.org Cc: David Howells , Marc Dionne , Jeffrey Altman , Simon Horman , linux-afs@lists.infradead.org, stable@kernel.org, Jakub Kicinski , Sasha Levin Subject: [PATCH 6.6.y] rxrpc: Fix key quota calculation for multitoken keys Date: Mon, 13 Apr 2026 18:27:13 -0400 Message-ID: <20260413222713.3754983-1-sashal@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <2026041335-rockslide-subduing-d935@gregkh> References: <2026041335-rockslide-subduing-d935@gregkh> Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: David Howells [ Upstream commit bdbfead6d38979475df0c2f4bad2b19394fe9bdc ] In the rxrpc key preparsing, every token extracted sets the proposed quota value, but for multitoken keys, this will overwrite the previous proposed quota, losing it. Fix this by adding to the proposed quota instead. Fixes: 8a7a3eb4ddbe ("KEYS: RxRPC: Use key preparsing") Closes: https://sashiko.dev/#/patchset/20260319150150.4189381-1-dhowells%40redhat.com Signed-off-by: David Howells cc: Marc Dionne cc: Jeffrey Altman cc: Simon Horman cc: linux-afs@lists.infradead.org cc: stable@kernel.org Link: https://patch.msgid.link/20260408121252.2249051-2-dhowells@redhat.com Signed-off-by: Jakub Kicinski [ dropped hunk for rxrpc_preparse_xdr_yfs_rxgk() ] Signed-off-by: Sasha Levin --- net/rxrpc/key.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/net/rxrpc/key.c b/net/rxrpc/key.c index 33e8302a79e33..215e661676381 100644 --- a/net/rxrpc/key.c +++ b/net/rxrpc/key.c @@ -72,7 +72,7 @@ static int rxrpc_preparse_xdr_rxkad(struct key_preparsed_payload *prep, return -EKEYREJECTED; plen = sizeof(*token) + sizeof(*token->kad) + tktlen; - prep->quotalen = datalen + plen; + prep->quotalen += datalen + plen; plen -= sizeof(*token); token = kzalloc(sizeof(*token), GFP_KERNEL); @@ -303,6 +303,7 @@ static int rxrpc_preparse(struct key_preparsed_payload *prep) memcpy(&kver, prep->data, sizeof(kver)); prep->data += sizeof(kver); prep->datalen -= sizeof(kver); + prep->quotalen = 0; _debug("KEY I/F VERSION: %u", kver); @@ -340,7 +341,7 @@ static int rxrpc_preparse(struct key_preparsed_payload *prep) goto error; plen = sizeof(*token->kad) + v1->ticket_length; - prep->quotalen = plen + sizeof(*token); + prep->quotalen += plen + sizeof(*token); ret = -ENOMEM; token = kzalloc(sizeof(*token), GFP_KERNEL); -- 2.53.0