From: Greg Kroah-Hartman Date: Fri, 24 Apr 2026 08:34:07 +0000 (+0200) Subject: 5.10-stable patches X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=0e4f1b6259810fb4d87d443ceb7f552023ff2d76;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: rxrpc-fix-anonymous-key-handling.patch rxrpc-only-handle-response-during-service-challenge.patch --- diff --git a/queue-5.10/rxrpc-fix-anonymous-key-handling.patch b/queue-5.10/rxrpc-fix-anonymous-key-handling.patch new file mode 100644 index 0000000000..a706bd2b17 --- /dev/null +++ b/queue-5.10/rxrpc-fix-anonymous-key-handling.patch @@ -0,0 +1,54 @@ +From stable+bounces-237690-greg=kroah.com@vger.kernel.org Tue Apr 14 02:41:24 2026 +From: Sasha Levin +Date: Mon, 13 Apr 2026 20:36:56 -0400 +Subject: rxrpc: Fix anonymous key handling +To: stable@vger.kernel.org +Cc: David Howells , Marc Dionne , Jeffrey Altman , Simon Horman , linux-afs@lists.infradead.org, stable@kernel.org, Jakub Kicinski , Sasha Levin +Message-ID: <20260414003656.3806621-1-sashal@kernel.org> + +From: David Howells + +[ Upstream commit 6a59d84b4fc2f27f7b40e348506cc686712e260b ] + +In rxrpc_new_client_call_for_sendmsg(), a key with no payload is meant to +be substituted for a NULL key pointer, but the variable this is done with +is subsequently not used. + +Fix this by using "key" rather than "rx->key" when filling in the +connection parameters. + +Note that this only affects direct use of AF_RXRPC; the kAFS filesystem +doesn't use sendmsg() directly and so bypasses the issue. Further, +AF_RXRPC passes a NULL key in if no key is set, so using an anonymous key +in that manner works. Since this hasn't been noticed to this point, it +might be better just to remove the "key" variable and the code that sets it +- and, arguably, rxrpc_init_client_call_security() would be a better place +to handle it. + +Fixes: 19ffa01c9c45 ("rxrpc: Use structs to hold connection params and protocol info") +Closes: https://sashiko.dev/#/patchset/20260319150150.4189381-1-dhowells%40redhat.com +Signed-off-by: David Howells +cc: Marc Dionne +cc: Jeffrey Altman +cc: Simon Horman +cc: linux-afs@lists.infradead.org +cc: stable@kernel.org +Link: https://patch.msgid.link/20260408121252.2249051-4-dhowells@redhat.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/rxrpc/sendmsg.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/rxrpc/sendmsg.c ++++ b/net/rxrpc/sendmsg.c +@@ -641,7 +641,7 @@ rxrpc_new_client_call_for_sendmsg(struct + + memset(&cp, 0, sizeof(cp)); + cp.local = rx->local; +- cp.key = rx->key; ++ cp.key = key; + cp.security_level = rx->min_sec_level; + cp.exclusive = rx->exclusive | p->exclusive; + cp.upgrade = p->upgrade; diff --git a/queue-5.10/rxrpc-only-handle-response-during-service-challenge.patch b/queue-5.10/rxrpc-only-handle-response-during-service-challenge.patch new file mode 100644 index 0000000000..ec72cc8a2b --- /dev/null +++ b/queue-5.10/rxrpc-only-handle-response-during-service-challenge.patch @@ -0,0 +1,90 @@ +From stable+bounces-237841-greg=kroah.com@vger.kernel.org Tue Apr 14 14:04:27 2026 +From: Sasha Levin +Date: Tue, 14 Apr 2026 07:56:13 -0400 +Subject: rxrpc: only handle RESPONSE during service challenge +To: stable@vger.kernel.org +Cc: Wang Jie , Yifan Wu , Juefei Pu , Yuan Tan , Xin Liu , Yang Yang , David Howells , Marc Dionne , Jeffrey Altman , Simon Horman , linux-afs@lists.infradead.org, stable@kernel.org, Jakub Kicinski , Sasha Levin +Message-ID: <20260414115613.548439-1-sashal@kernel.org> + +From: Wang Jie + +[ Upstream commit c43ffdcfdbb5567b1f143556df8a04b4eeea041c ] + +Only process RESPONSE packets while the service connection is still in +RXRPC_CONN_SERVICE_CHALLENGING. Check that state under state_lock before +running response verification and security initialization, then use a local +secured flag to decide whether to queue the secured-connection work after +the state transition. This keeps duplicate or late RESPONSE packets from +re-running the setup path and removes the unlocked post-transition state +test. + +Fixes: 17926a79320a ("[AF_RXRPC]: Provide secure RxRPC sockets for use by userspace and kernel both") +Reported-by: Yifan Wu +Reported-by: Juefei Pu +Co-developed-by: Yuan Tan +Signed-off-by: Yuan Tan +Suggested-by: Xin Liu +Signed-off-by: Jie Wang +Signed-off-by: Yang Yang +Signed-off-by: David Howells +cc: Marc Dionne +cc: Jeffrey Altman +cc: Simon Horman +cc: linux-afs@lists.infradead.org +cc: stable@kernel.org +Link: https://patch.msgid.link/20260408121252.2249051-21-dhowells@redhat.com +Signed-off-by: Jakub Kicinski +[ adapted to spin_lock_bh usage, 3-arg verify_response(), and direct rxrpc_call_is_secure() ] +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/rxrpc/conn_event.c | 17 +++++++++++++---- + 1 file changed, 13 insertions(+), 4 deletions(-) + +--- a/net/rxrpc/conn_event.c ++++ b/net/rxrpc/conn_event.c +@@ -293,6 +293,7 @@ static int rxrpc_process_event(struct rx + u32 *_abort_code) + { + struct rxrpc_skb_priv *sp = rxrpc_skb(skb); ++ bool secured = false; + __be32 wtmp; + u32 abort_code; + int loop, ret; +@@ -337,6 +338,13 @@ static int rxrpc_process_event(struct rx + _abort_code); + + case RXRPC_PACKET_TYPE_RESPONSE: ++ spin_lock_bh(&conn->state_lock); ++ if (conn->state != RXRPC_CONN_SERVICE_CHALLENGING) { ++ spin_unlock_bh(&conn->state_lock); ++ return 0; ++ } ++ spin_unlock_bh(&conn->state_lock); ++ + ret = conn->security->verify_response(conn, skb, _abort_code); + if (ret < 0) + return ret; +@@ -351,17 +359,18 @@ static int rxrpc_process_event(struct rx + + spin_lock(&conn->bundle->channel_lock); + spin_lock_bh(&conn->state_lock); +- + if (conn->state == RXRPC_CONN_SERVICE_CHALLENGING) { + conn->state = RXRPC_CONN_SERVICE; +- spin_unlock_bh(&conn->state_lock); ++ secured = true; ++ } ++ spin_unlock_bh(&conn->state_lock); ++ ++ if (secured) { + for (loop = 0; loop < RXRPC_MAXCALLS; loop++) + rxrpc_call_is_secure( + rcu_dereference_protected( + conn->channels[loop].call, + lockdep_is_held(&conn->bundle->channel_lock))); +- } else { +- spin_unlock_bh(&conn->state_lock); + } + + spin_unlock(&conn->bundle->channel_lock); diff --git a/queue-5.10/series b/queue-5.10/series index 83b6495652..81ff679425 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -126,3 +126,5 @@ i3c-fix-uninitialized-variable-use-in-i2c-setup.patch revert-scsi-ufs-core-improve-scsi-abort-handling.patch rxrpc-fix-recvmsg-unconditional-requeue.patch cifs-fix-connections-leak-when-tlink-setup-failed.patch +rxrpc-only-handle-response-during-service-challenge.patch +rxrpc-fix-anonymous-key-handling.patch