From nobody Wed Jun 17 02:52:13 2026 Received: from mail-dl1-f53.google.com (mail-dl1-f53.google.com [74.125.82.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9F8D82AE8D for ; Wed, 22 Apr 2026 00:32:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.53 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776817965; cv=none; b=lMiCRtflrxsOfCuchtp/qVpQt1ldcumySxU5+fyP9UjTitwkt6TqMMR4T1uVoHy3wb6MGsVnfZ/hkxB8QOBUELcZ7h+HFuLvIKyCVMcsmfd+okmugyrE4dcO33HsPUw265XJQjj533j+RTTNY4QsRVcvWHXzWqGkv63r3XzFr0w= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776817965; c=relaxed/simple; bh=lwhpGMqxIEBExeODsinJdwdIIPKJoJrL3AlkOug02z0=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=SrbvmIFqwtESen6gpeQ/0eSi5SAcS4hklvNrZSEsZnHxUhmROO2koMpUqlqAca2Wsbgc8Sg6h+2w3mNFqktaAaLut8X0FXdosomiJGwnYSnXHvNHNXR1SRWVRUt1IJlcsG4X0Svt6tr99xHhFXUyhGTMdNACTjfDx7AIbSkurGI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=allelesecurity.com; spf=pass smtp.mailfrom=allelesecurity.com; dkim=pass (1024-bit key) header.d=allelesecurity.com header.i=@allelesecurity.com header.b=CgYG5p2U; arc=none smtp.client-ip=74.125.82.53 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=allelesecurity.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=allelesecurity.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=allelesecurity.com header.i=@allelesecurity.com header.b="CgYG5p2U" Received: by mail-dl1-f53.google.com with SMTP id a92af1059eb24-12d4bed3384so2484706c88.0 for ; Tue, 21 Apr 2026 17:32:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=allelesecurity.com; s=google; t=1776817964; x=1777422764; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=zLEffq/KmF5N2hbyrZmLE4zdinUJ9bGrO17RsFPNg3g=; b=CgYG5p2UwsuSQAn6wXiZovPgRIbVmOOO5sUgCpWotehT/E/kQ0s4TmCTENvLeMtb9W 3+ck9fGZaDGtEyOHcmtpWtf6Gf7S9OSgreImiMaY6PFdVOTMRCsaUKyT/RtXBkaVwl2v R8e36Zx50pl1Q63oXGAjRquBryWEqP8mOoK/Y= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1776817964; x=1777422764; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=zLEffq/KmF5N2hbyrZmLE4zdinUJ9bGrO17RsFPNg3g=; b=cMhSWcyiN2Rop8x5VeJnE7pdg4bFAjA0dQRVbT4TsbNUZe/wxynZVX4UBezusTw4Hw BOjuRFGRE38pyzgtKhiqCyFWtgTiOZ6XzATZwAZZZJim0tNPhY5/Ec41ciINONamJVEe s+Aa21BitPEh0SMFm+d69JYPN6H10SGYzYcugvBFXaNRRC9ZDUSa9taUlsdYRmGctnIF QVGYg/y9+5oUI88GC4GTtBQA36WQEgVEP6GyXmuvRjmQcVwAbJUe3VfCD5sY7C9Zg6GH iZULPGqmVu0qC7QkpuxIVj/rE/I4F3Zs1MnDmaqPlH9AmUYu0kF3i8VQJEMZbrcFitc+ z8oA== X-Forwarded-Encrypted: i=1; AFNElJ8l16wquSNYER1O2Q1lu+WTCmBQQBAgxISM8w2x7ygGrGBnCfs5aSy6hv0Nbh2FFE8NHTFaev39vSucsiw=@vger.kernel.org X-Gm-Message-State: AOJu0YzZG5rRguIOQzTImn7G+Ggbd3yLSHN7XReBbYP48H1ylt+DHmBQ uV2lUqq1Z0pbhjX+4+b4OXNqrkp05B5MmtCT5FSA4MHd60MlfINCh3C+p2GucXtrR4M= X-Gm-Gg: AeBDievK4BK+KL/c+Sdzv6R6zBSYkzTmtMd4EbmnTsr3/jwREgsOhN85kaON7MkudtT OxgjkR6uLcuHKKjM+LLjPxGcAVXe+xg9+2SDDI49z8gIY1evb/9DL1vkI7a1YlJjjZsixQeXWYA 8tlopzOYVsWfrADXREmN+V4pxnRo1JKUPaiIS6jf24lnYe6XZmNpeOC1B/UdR8CIC5cdBFuDEJa W4932GCZozPqxj2o5eHQawSao2ZzOeQfTqtzALM+8ChYVVCmy72QnTdYFNmHMtEi7Mvh+zESPBg iV9v/V2ahsR4jDmL6GNGmu1Jtnq30gBquqyntDnCa3hyHfNJwHk5cz4bEZrr8qrcB1aDrFO3jZT qzy8WD+m280lYM94zt5qCUz2LQzss0cXUMbNi5QNyHq18YqVQB3INwHbjTYIntodQ4Fy69ywPFx KDeMZhNhyp3uF65Nm6sDkC/y+w/gB1Z5/tmpyIMR7MWg+zyBlD X-Received: by 2002:a05:7022:458d:b0:128:d51a:5161 with SMTP id a92af1059eb24-12c73fa2244mr10513913c88.27.1776817963615; Tue, 21 Apr 2026 17:32:43 -0700 (PDT) Received: from fedora ([179.105.152.38]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-12c749c422csm21693851c88.3.2026.04.21.17.32.38 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 21 Apr 2026 17:32:43 -0700 (PDT) From: Anderson Nascimento To: David Howells , Marc Dionne , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Steve Dickson Cc: Anderson Nascimento , linux-afs@lists.infradead.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH] rxrpc: fix missing validation of ticket length in Date: Tue, 21 Apr 2026 21:32:05 -0300 Message-ID: <20260422003206.1017863-1-anderson@allelesecurity.com> X-Mailer: git-send-email 2.53.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" In rxrpc_preparse(), there are two paths for parsing key payloads: the XDR path (for large payloads) and the non-XDR path (for payloads <=3D 28 bytes). While the XDR path (rxrpc_preparse_xdr_rxkad()) correctly validates the ticket length against AFSTOKEN_RK_TIX_MAX, the non-XDR path fails to do so. This allows an unprivileged user to provide a very large ticket length. When this key is later read via rxrpc_read(), the total token size (toksize) calculation results in a value that exceeds AFSTOKEN_LENGTH_MAX, triggering a WARN_ON(). [ 2001.302904] WARNING: CPU: 2 PID: 2108 at net/rxrpc/key.c:778 rxrpc_read+= 0x109/0x5c0 [rxrpc] Fix this by adding a check in the non-XDR parsing path of rxrpc_preparse() to ensure the ticket length does not exceed AFSTOKEN_RK_TIX_MAX, bringing it into parity with the XDR parsing logic. Fixes: 8a7a3eb4ddbe ("KEYS: RxRPC: Use key preparsing") Fixes: 84924aac08a4 ("rxrpc: Fix checker warning") Reported-by: Anderson Nascimento Signed-off-by: Anderson Nascimento --- net/rxrpc/key.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/rxrpc/key.c b/net/rxrpc/key.c index 6301d79ee35a..5ebb06d87cdd 100644 --- a/net/rxrpc/key.c +++ b/net/rxrpc/key.c @@ -502,6 +502,10 @@ static int rxrpc_preparse(struct key_preparsed_payload= *prep) if (v1->security_index !=3D RXRPC_SECURITY_RXKAD) goto error; =20 + ret =3D -EKEYREJECTED; + if(v1->ticket_length > AFSTOKEN_RK_TIX_MAX) + goto error; + plen =3D sizeof(*token->kad) + v1->ticket_length; prep->quotalen +=3D plen + sizeof(*token); =20 --=20 2.53.0