From: Greg Kroah-Hartman Date: Fri, 24 Apr 2026 08:34:50 +0000 (+0200) Subject: 6.6-stable patches X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=eec0e64aa2433336be9ebdc6a887e7f267e7cd83;p=thirdparty%2Fkernel%2Fstable-queue.git 6.6-stable patches added patches: rxrpc-fix-anonymous-key-handling.patch rxrpc-only-handle-response-during-service-challenge.patch --- diff --git a/queue-6.6/rxrpc-fix-anonymous-key-handling.patch b/queue-6.6/rxrpc-fix-anonymous-key-handling.patch new file mode 100644 index 0000000000..dd597686ab --- /dev/null +++ b/queue-6.6/rxrpc-fix-anonymous-key-handling.patch @@ -0,0 +1,54 @@ +From stable+bounces-237685-greg=kroah.com@vger.kernel.org Tue Apr 14 02:18:08 2026 +From: Sasha Levin +Date: Mon, 13 Apr 2026 20:17:56 -0400 +Subject: rxrpc: Fix anonymous key handling +To: stable@vger.kernel.org +Cc: David Howells , Marc Dionne , Jeffrey Altman , Simon Horman , linux-afs@lists.infradead.org, stable@kernel.org, Jakub Kicinski , Sasha Levin +Message-ID: <20260414001756.3797211-1-sashal@kernel.org> + +From: David Howells + +[ Upstream commit 6a59d84b4fc2f27f7b40e348506cc686712e260b ] + +In rxrpc_new_client_call_for_sendmsg(), a key with no payload is meant to +be substituted for a NULL key pointer, but the variable this is done with +is subsequently not used. + +Fix this by using "key" rather than "rx->key" when filling in the +connection parameters. + +Note that this only affects direct use of AF_RXRPC; the kAFS filesystem +doesn't use sendmsg() directly and so bypasses the issue. Further, +AF_RXRPC passes a NULL key in if no key is set, so using an anonymous key +in that manner works. Since this hasn't been noticed to this point, it +might be better just to remove the "key" variable and the code that sets it +- and, arguably, rxrpc_init_client_call_security() would be a better place +to handle it. + +Fixes: 19ffa01c9c45 ("rxrpc: Use structs to hold connection params and protocol info") +Closes: https://sashiko.dev/#/patchset/20260319150150.4189381-1-dhowells%40redhat.com +Signed-off-by: David Howells +cc: Marc Dionne +cc: Jeffrey Altman +cc: Simon Horman +cc: linux-afs@lists.infradead.org +cc: stable@kernel.org +Link: https://patch.msgid.link/20260408121252.2249051-4-dhowells@redhat.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/rxrpc/sendmsg.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/rxrpc/sendmsg.c ++++ b/net/rxrpc/sendmsg.c +@@ -590,7 +590,7 @@ rxrpc_new_client_call_for_sendmsg(struct + + memset(&cp, 0, sizeof(cp)); + cp.local = rx->local; +- cp.key = rx->key; ++ cp.key = key; + cp.security_level = rx->min_sec_level; + cp.exclusive = rx->exclusive | p->exclusive; + cp.upgrade = p->upgrade; diff --git a/queue-6.6/rxrpc-only-handle-response-during-service-challenge.patch b/queue-6.6/rxrpc-only-handle-response-during-service-challenge.patch new file mode 100644 index 0000000000..9002768716 --- /dev/null +++ b/queue-6.6/rxrpc-only-handle-response-during-service-challenge.patch @@ -0,0 +1,83 @@ +From stable+bounces-237816-greg=kroah.com@vger.kernel.org Tue Apr 14 13:26:40 2026 +From: Sasha Levin +Date: Tue, 14 Apr 2026 07:25:21 -0400 +Subject: rxrpc: only handle RESPONSE during service challenge +To: stable@vger.kernel.org +Cc: Wang Jie , Yifan Wu , Juefei Pu , Yuan Tan , Xin Liu , Yang Yang , David Howells , Marc Dionne , Jeffrey Altman , Simon Horman , linux-afs@lists.infradead.org, stable@kernel.org, Jakub Kicinski , Sasha Levin +Message-ID: <20260414112521.410826-2-sashal@kernel.org> + +From: Wang Jie + +[ Upstream commit c43ffdcfdbb5567b1f143556df8a04b4eeea041c ] + +Only process RESPONSE packets while the service connection is still in +RXRPC_CONN_SERVICE_CHALLENGING. Check that state under state_lock before +running response verification and security initialization, then use a local +secured flag to decide whether to queue the secured-connection work after +the state transition. This keeps duplicate or late RESPONSE packets from +re-running the setup path and removes the unlocked post-transition state +test. + +Fixes: 17926a79320a ("[AF_RXRPC]: Provide secure RxRPC sockets for use by userspace and kernel both") +Reported-by: Yifan Wu +Reported-by: Juefei Pu +Co-developed-by: Yuan Tan +Signed-off-by: Yuan Tan +Suggested-by: Xin Liu +Signed-off-by: Jie Wang +Signed-off-by: Yang Yang +Signed-off-by: David Howells +cc: Marc Dionne +cc: Jeffrey Altman +cc: Simon Horman +cc: linux-afs@lists.infradead.org +cc: stable@kernel.org +Link: https://patch.msgid.link/20260408121252.2249051-21-dhowells@redhat.com +Signed-off-by: Jakub Kicinski +[ adapted spin_lock_irq/spin_unlock_irq calls to spin_lock/spin_unlock ] +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/rxrpc/conn_event.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +--- a/net/rxrpc/conn_event.c ++++ b/net/rxrpc/conn_event.c +@@ -233,6 +233,7 @@ static int rxrpc_process_event(struct rx + struct sk_buff *skb) + { + struct rxrpc_skb_priv *sp = rxrpc_skb(skb); ++ bool secured = false; + int ret; + + if (conn->state == RXRPC_CONN_ABORTED) +@@ -245,6 +246,13 @@ static int rxrpc_process_event(struct rx + return conn->security->respond_to_challenge(conn, skb); + + case RXRPC_PACKET_TYPE_RESPONSE: ++ spin_lock(&conn->state_lock); ++ if (conn->state != RXRPC_CONN_SERVICE_CHALLENGING) { ++ spin_unlock(&conn->state_lock); ++ return 0; ++ } ++ spin_unlock(&conn->state_lock); ++ + ret = conn->security->verify_response(conn, skb); + if (ret < 0) + return ret; +@@ -255,11 +263,13 @@ static int rxrpc_process_event(struct rx + return ret; + + spin_lock(&conn->state_lock); +- if (conn->state == RXRPC_CONN_SERVICE_CHALLENGING) ++ if (conn->state == RXRPC_CONN_SERVICE_CHALLENGING) { + conn->state = RXRPC_CONN_SERVICE; ++ secured = true; ++ } + spin_unlock(&conn->state_lock); + +- if (conn->state == RXRPC_CONN_SERVICE) { ++ if (secured) { + /* Offload call state flipping to the I/O thread. As + * we've already received the packet, put it on the + * front of the queue. diff --git a/queue-6.6/series b/queue-6.6/series index a717838d9d..dff5d13c2c 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -140,3 +140,5 @@ ocfs2-validate-inline-data-i_size-during-inode-read.patch ocfs2-fix-out-of-bounds-write-in-ocfs2_write_end_inline.patch revert-wifi-cfg80211-stop-nan-and-p2p-in-cfg80211_leave.patch scripts-dtc-remove-unused-dts_version-in-dtc-lexer.l.patch +rxrpc-fix-anonymous-key-handling.patch +rxrpc-only-handle-response-during-service-challenge.patch