github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-29 02:31:27 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
v7.1-rc7
linux/net/rxrpc
History
David Howells 8bfab4b6ff rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer 
This improves the fix for CVE-2026-43500.

Fix the verification of RESPONSE packets to avoid the problem of
overwriting a RESPONSE packet sent via splice to a local address by
extracting the contents of the UDP packet into a kmalloc'd linear buffer
rather than decrypting the data in place in the sk_buff (which may corrupt
the original buffer).

Fixes: 24481a7f57 ("rxrpc: Fix conn-level packet handling to unshare RESPONSE packets")
Reported-by: Hyunwoo Kim <imv4bel@gmail.com>
Closes: https://lore.kernel.org/r/afKV2zGR6rrelPC7@v4bel/
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Simon Horman <horms@kernel.org>
cc: Jiayuan Chen <jiayuan.chen@linux.dev>
cc: linux-afs@lists.infradead.org
cc: stable@kernel.org
Reviewed-by: Jeffrey Altman <jaltman@auristor.com>
Tested-by: Marc Dionne <marc.dionne@auristor.com>
Link: https://patch.msgid.link/20260515230516.2718212-4-dhowells@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-20 16:36:45 -07:00
..
af_rxrpc.c rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING) 2026-04-08 18:44:34 -07:00
ar-internal.h rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer 2026-05-20 16:36:45 -07:00
call_accept.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
call_event.c rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg 2026-05-20 16:36:45 -07:00
call_object.c rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg 2026-05-20 16:36:45 -07:00
call_state.c rxrpc: Move client call connection to the I/O thread 2023-01-06 09:43:33 +00:00
conn_client.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
conn_event.c rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer 2026-05-20 16:36:45 -07:00
conn_object.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
conn_service.c rxrpc_find_service_conn_rcu: fix the usage of read_seqbegin_or_lock() 2023-12-24 15:22:49 +00:00
input_rack.c rxrpc: Fix rack timer warning to report unexpected mode 2026-04-08 18:44:32 -07:00
input.c rxrpc: peer->mtu_lock is redundant 2025-02-21 15:06:29 -08:00
insecure.c rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer 2026-05-20 16:36:45 -07:00
io_thread.c rxrpc: Fix potential UAF after skb_unshare() failure 2026-04-23 12:40:52 -07:00
Kconfig ipv6: convert CONFIG_IPV6 to built-in only and clean up Kconfigs 2026-03-29 11:21:22 -07:00
key.c rxrpc: Fix missing validation of ticket length in non-XDR key preparsing 2026-04-23 12:41:49 -07:00
local_event.c rxrpc: Truncate UTS_RELEASE for rxrpc version 2023-05-30 10:01:06 +02:00
local_object.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
Makefile rxrpc: rxgk: Implement the yfs-rxgk security class (GSSAPI) 2025-04-14 17:36:42 -07:00
misc.c rxrpc: Implement path-MTU probing using padded PING ACKs (RFC8899) 2024-12-09 13:48:25 -08:00
net_ns.c treewide: Switch/rename to timer_delete[_sync]() 2025-04-05 10:30:12 +02:00
oob.c rxrpc: Allow the app to store private data on peer structs 2025-04-14 17:36:42 -07:00
output.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-04-09 13:20:59 -07:00
peer_event.c rxrpc: Fix data-race warning and potential load/store tearing 2026-01-21 19:59:29 -08:00
peer_object.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
proc.c rxrpc: proc: size address buffers for %pISpc output 2026-04-08 18:45:32 -07:00
protocol.h rxrpc: rxgk: Implement the yfs-rxgk security class (GSSAPI) 2025-04-14 17:36:42 -07:00
recvmsg.c rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg 2026-05-20 16:36:45 -07:00
rtt.c rxrpc: Manage RTT per-call rather than per-peer 2024-12-09 13:48:32 -08:00
rxgk_app.c rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer 2026-05-20 16:36:45 -07:00
rxgk_common.h rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer 2026-05-20 16:36:45 -07:00
rxgk_kdf.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
rxgk.c rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer 2026-05-20 16:36:45 -07:00
rxkad.c rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer 2026-05-20 16:36:45 -07:00
rxperf.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
security.c rxrpc: Fix to use conn aborts for conn-wide failures 2025-07-17 07:50:48 -07:00
sendmsg.c rxrpc: Fix anonymous key handling 2026-04-08 18:44:31 -07:00
server_key.c rxrpc: fix reference count leak in rxrpc_server_keyring() 2026-04-08 18:44:33 -07:00
skbuff.c rxrpc: Fix potential UAF after skb_unshare() failure 2026-04-23 12:40:52 -07:00
sysctl.c rxrpc: Implement path-MTU probing using padded PING ACKs (RFC8899) 2024-12-09 13:48:25 -08:00
txbuf.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
utils.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 36 2019-05-24 17:27:11 +02:00