rxrpc: Fix key quota calculation for multitoken keys

commit bdbfead6d38979475df0c2f4bad2b19394fe9bdc upstream.

In the rxrpc key preparsing, every token extracted sets the proposed quota
value, but for multitoken keys, this will overwrite the previous proposed
quota, losing it.

Fix this by adding to the proposed quota instead.

Fixes: 8a7a3eb4ddbe ("KEYS: RxRPC: Use key preparsing")
Closes: https://sashiko.dev/#/patchset/20260319150150.4189381-1-dhowells%40redhat.com
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: Jeffrey Altman <jaltman@auristor.com>
cc: Simon Horman <horms@kernel.org>
cc: linux-afs@lists.infradead.org
cc: stable@kernel.org
Link: https://patch.msgid.link/20260408121252.2249051-2-dhowells@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/net/rxrpc/key.c b/net/rxrpc/key.c
index 9fdc1f031c9daeb96529799bb1196da633aaba18..bac2afdb3548c7a937af5af4d3263532d40532b5 100644 (file)
--- a/net/rxrpc/key.c
+++ b/net/rxrpc/key.c
@@ -72,7 +72,7 @@ static int rxrpc_preparse_xdr_rxkad(struct key_preparsed_payload *prep,
                return -EKEYREJECTED;
 
        plen = sizeof(*token) + sizeof(*token->kad) + tktlen;
-       prep->quotalen = datalen + plen;
+       prep->quotalen += datalen + plen;
 
        plen -= sizeof(*token);
        token = kzalloc(sizeof(*token), GFP_KERNEL);
@@ -199,7 +199,7 @@ static int rxrpc_preparse_xdr_yfs_rxgk(struct key_preparsed_payload *prep,
        }
 
        plen = sizeof(*token) + sizeof(*token->rxgk) + tktlen + keylen;
-       prep->quotalen = datalen + plen;
+       prep->quotalen += datalen + plen;
 
        plen -= sizeof(*token);
        token = kzalloc(sizeof(*token), GFP_KERNEL);
@@ -460,6 +460,7 @@ static int rxrpc_preparse(struct key_preparsed_payload *prep)
        memcpy(&kver, prep->data, sizeof(kver));
        prep->data += sizeof(kver);
        prep->datalen -= sizeof(kver);
+       prep->quotalen = 0;
 
        _debug("KEY I/F VERSION: %u", kver);
 
@@ -497,7 +498,7 @@ static int rxrpc_preparse(struct key_preparsed_payload *prep)
                goto error;
 
        plen = sizeof(*token->kad) + v1->ticket_length;
-       prep->quotalen = plen + sizeof(*token);
+       prep->quotalen += plen + sizeof(*token);
 
        ret = -ENOMEM;
        token = kzalloc(sizeof(*token), GFP_KERNEL);