Skip to contentSkip to conversation

rxrpc: Miscellaneous fixes

PATCH Applied David Howells 2 participants 5 messages Apr 23

Subsystems (4)
Networking Network drivers Tracing Rxrpc sockets (AF_RXRPC)
lore
Share & tools
lore

David Howells

author maintainer
#0 lore raw

cover rxrpc: Miscellaneous fixes

Here are some fixes for rxrpc, as found by Sashiko[1]:

(1) Fix rxrpc_input_call_event() to only unshare DATA packets.

(2) Fix re-decryption of RESPONSE packets where a partially decrypted skbuff gets requeued if there was a failure due to ENOMEM.

(3) Fix error handling in rxgk_extract_token() where the ENOMEM case is unhandled.

David

The patches can be found here also:

http://git.kernel.org/cgit/linux/kernel/git/dhowells/linux-fs.git/log/?h=rxrpc-fixes

Link https://sashiko.dev/#/patchset/[email protected] [1]

David Howells (3):
rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets
rxrpc: Fix re-decryption of RESPONSE packets
rxrpc: Fix error handling in rxgk_extract_token()

 include/trace/events/rxrpc.h |  1 -
 net/rxrpc/call_event.c       |  3 ++-
 net/rxrpc/conn_event.c       | 14 ++------------
 net/rxrpc/rxgk_app.c         |  1 +
 4 files changed, 5 insertions(+), 14 deletions(-)
author maintainer
#1 lore raw

PATCH 1/3 rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets

Fix rxrpc_input_call_event() to only unshare DATA packets and not ACK, ABORT, etc..

And with that, rxrpc_input_packet() doesn't need to take a pointer to the pointer to the packet, so change that to just a pointer.

Fixes 1f2740150f90 ("rxrpc: Fix potential UAF after skb_unshare() failure")
Closes https://sashiko.dev/#/patchset/[email protected]
Signed-off-by David Howells <[email protected]>
cc Marc Dionne <[email protected]>
cc Jeffrey Altman <[email protected]>
cc Eric Dumazet <[email protected]>
cc "David S. Miller" <[email protected]>
cc Jakub Kicinski <[email protected]>
cc Paolo Abeni <[email protected]>
cc Simon Horman <[email protected]>
cc [email protected]
cc [email protected]
cc [email protected]
---
 net/rxrpc/call_event.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
net/rxrpc/call_event.c +2 -1
index cc8f9dfa44e8..fdd683261226 100644
@@ -332,7 +332,8 @@ bool rxrpc_input_call_event(struct rxrpc_call *call)
 
 			saw_ack |= sp->hdr.type == RXRPC_PACKET_TYPE_ACK;
 
-			if (sp->hdr.securityIndex != 0 &&
+			if (sp->hdr.type == RXRPC_PACKET_TYPE_DATA &&
+			    sp->hdr.securityIndex != 0 &&
 			    skb_cloned(skb)) {
 				/* Unshare the packet so that it can be
 				 * modified by in-place decryption.
author maintainer
#2 lore raw

PATCH 2/3 rxrpc: Fix re-decryption of RESPONSE packets

In reply to David Howells

If a RESPONSE packet gets a temporary failure during processing, it may end up in a partially decrypted state - and then get requeued for a retry.

Fix this by just discarding the packet; we will send another CHALLENGE packet and thereby elicit a further response. Similarly, discard an incoming CHALLENGE packet if we get an error whilst generating a RESPONSE; the server will send another CHALLENGE.

Fixes 17926a79320a ("[AF_RXRPC]: Provide secure RxRPC sockets for use by userspace and kernel both")
Closes https://sashiko.dev/#/patchset/[email protected]
Signed-off-by David Howells <[email protected]>
cc Marc Dionne <[email protected]>
cc Jeffrey Altman <[email protected]>
cc Eric Dumazet <[email protected]>
cc "David S. Miller" <[email protected]>
cc Jakub Kicinski <[email protected]>
cc Paolo Abeni <[email protected]>
cc Simon Horman <[email protected]>
cc [email protected]
cc [email protected]
cc [email protected]
---
 include/trace/events/rxrpc.h |  1 -
 net/rxrpc/conn_event.c       | 14 ++------------
 2 files changed, 2 insertions(+), 13 deletions(-)
include/trace/events/rxrpc.h +0 -1
index 13b9d017f8e1..573f2df3a2c9 100644
@@ -285,7 +285,6 @@
 	EM(rxrpc_conn_put_unidle,		"PUT unidle  ") \
 	EM(rxrpc_conn_put_work,			"PUT work    ") \
 	EM(rxrpc_conn_queue_challenge,		"QUE chall   ") \
-	EM(rxrpc_conn_queue_retry_work,		"QUE retry-wk") \
 	EM(rxrpc_conn_queue_rx_work,		"QUE rx-work ") \
 	EM(rxrpc_conn_see_new_service_conn,	"SEE new-svc ") \
 	EM(rxrpc_conn_see_reap_service,		"SEE reap-svc") \
net/rxrpc/conn_event.c +2 -12
index aee977291d90..a2130d25aaa9 100644
@@ -389,7 +389,6 @@ void rxrpc_process_delayed_final_acks(struct rxrpc_connection *conn, bool force)
 static void rxrpc_do_process_connection(struct rxrpc_connection *conn)
 {
 	struct sk_buff *skb;
-	int ret;
 
 	if (test_and_clear_bit(RXRPC_CONN_EV_CHALLENGE, &conn->events))
 		rxrpc_secure_connection(conn);

@@ -398,17 +397,8 @@ static void rxrpc_do_process_connection(struct rxrpc_connection *conn)
 	 * connection that each one has when we've finished with it */
 	while ((skb = skb_dequeue(&conn->rx_queue))) {
 		rxrpc_see_skb(skb, rxrpc_skb_see_conn_work);
-		ret = rxrpc_process_event(conn, skb);
-		switch (ret) {
-		case -ENOMEM:
-		case -EAGAIN:
-			skb_queue_head(&conn->rx_queue, skb);
-			rxrpc_queue_conn(conn, rxrpc_conn_queue_retry_work);
-			break;
-		default:
-			rxrpc_free_skb(skb, rxrpc_skb_put_conn_work);
-			break;
-		}
+		rxrpc_process_event(conn, skb);
+		rxrpc_free_skb(skb, rxrpc_skb_put_conn_work);
 	}
 }
author maintainer
#3 lore raw

PATCH 3/3 rxrpc: Fix error handling in rxgk_extract_token()

In reply to David Howells

Fix a missing bit of error handling in rxgk_extract_token(): in the event that rxgk_decrypt_skb() returns -ENOMEM, it should just return that rather than continuing on (for anything else, it generates an abort).

Fixes 64863f4ca494 ("rxrpc: Fix unhandled errors in rxgk_verify_packet_integrity()")
Closes https://sashiko.dev/#/patchset/[email protected]
Signed-off-by David Howells <[email protected]>
cc Marc Dionne <[email protected]>
cc Jeffrey Altman <[email protected]>
cc Eric Dumazet <[email protected]>
cc "David S. Miller" <[email protected]>
cc Jakub Kicinski <[email protected]>
cc Paolo Abeni <[email protected]>
cc Simon Horman <[email protected]>
cc [email protected]
cc [email protected]
cc [email protected]
---
 net/rxrpc/rxgk_app.c | 1 +
 1 file changed, 1 insertion(+)
net/rxrpc/rxgk_app.c +1 -0
index 5587639d60c5..0ef2a29eb695 100644
@@ -245,6 +245,7 @@ int rxgk_extract_token(struct rxrpc_connection *conn, struct sk_buff *skb,
 		if (ret != -ENOMEM)
 			return rxrpc_abort_conn(conn, skb, ec, ret,
 						rxgk_abort_resp_tok_dec);
+		return ret;
 	}
 
 	ret = conn->security->default_decode_ticket(conn, skb, ticket_offset,
CI Applied
#4 lore raw
In reply to David Howells
This series was applied to netdev/net.git (main) by Jakub Kicinski <[email protected]>:

Hello:

This series was applied to netdev/net.git (main)
by Jakub Kicinski <[email protected]>:

Quoted 8 lines · On Thu, 23 Apr 2026 21:09:05 +0100 you wrote:

Here are some fixes for rxrpc, as found by Sashiko[1]:

(1) Fix rxrpc_input_call_event() to only unshare DATA packets.

(2) Fix re-decryption of RESPONSE packets where a partially decrypted skbuff gets requeued if there was a failure due to ENOMEM.

[...]

Here is the summary with links:
- [net,1/3] rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets

    https://git.kernel.org/netdev/net/c/55b2984c96c3
  - [net,2/3] rxrpc: Fix re-decryption of RESPONSE packets
    https://git.kernel.org/netdev/net/c/0422e7a4883f
  - [net,3/3] rxrpc: Fix error handling in rxgk_extract_token()
    https://git.kernel.org/netdev/net/c/3476c8bb960f

You are awesome, thank you!

Signature · 2 lines
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html