rxrpc: Fix UAF in rxgk_issue_challenge()

Fix rxgk_issue_challenge() to free the page containing the challenge
content after invoking the tracepoint as the whdr passed to the tracepoint
points into the page just freed.

Fixes: 9d1d2b59341f ("rxrpc: rxgk: Implement the yfs-rxgk security class (GSSAPI)")
Reported-by: Marc Dionne <marc.dionne@auristor.com>
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Simon Horman <horms@kernel.org>
cc: linux-afs@lists.infradead.org
cc: stable@kernel.org
Link: https://patch.msgid.link/20260609140911.838677-4-dhowells@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/rxrpc/rxgk.c b/net/rxrpc/rxgk.c
index a1ee102abae18a3109f76e64eb95a91cdd7a48f2..77a67ace1d2481397658f9d57c58d463a9862192 100644 (file)
--- a/net/rxrpc/rxgk.c
+++ b/net/rxrpc/rxgk.c
@@ -687,16 +687,17 @@ static int rxgk_issue_challenge(struct rxrpc_connection *conn)
        ret = do_udp_sendmsg(conn->local->socket, &msg, len);
        if (ret > 0)
                rxrpc_peer_mark_tx(conn->peer);
-       __free_page(page);
 
        if (ret < 0) {
                trace_rxrpc_tx_fail(conn->debug_id, serial, ret,
                                    rxrpc_tx_point_rxgk_challenge);
+               __free_page(page);
                return -EAGAIN;
        }
 
        trace_rxrpc_tx_packet(conn->debug_id, whdr,
                              rxrpc_tx_point_rxgk_challenge);
+       __free_page(page);
        _leave(" = 0");
        return 0;
 }