From nobody Thu Oct 2 19:30:15 2025 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E845E2F531A for ; Thu, 11 Sep 2025 23:06:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1757631989; cv=none; b=Q0mzV0Jlm+rGW7ESI+pT8xq+E3LdNSPSo1DdtpzfaTA7E+jqljYyESilARD3q2hhUz5JBxGu4PY5YlQu106y1wzgUc7RTOXacKgG83tKULQ+I/lxzTxtg/uAooQTUSFNpaRSUwJ92yph2QXWl+EpnvvHVabfeejg6SPOScLrVdI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1757631989; c=relaxed/simple; bh=zYm0m59md0YmJAnONrIhr+tPVXmFfeUu+aOXXuIcRMY=; h=From:To:cc:Subject:MIME-Version:Content-Type:Date:Message-ID; b=auqT9/qD4tvAtNDk7pK8TVeRBrepfxBwozTpSmzfEBqdsrBTjCt/r3vHG84UuYef8s6CfyQhmIAJA9NjEThVJltzYMvv6wxy0n0ZfYnCX7s7fej4jJFYnwsf0kF4w8PNWcYjZPZMf9b6yZWvZap7DJOyy8jL1uyPpmR8aLt/d60= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=Xamq+/uq; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="Xamq+/uq" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1757631986; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=OQwBcPZWGnJ87xzP7ruqoRhyhedrtIzZGOwOMMIChZg=; b=Xamq+/uq82BqIkgUYI+8gjYFCh8UhuPGlrpXY3gTQAWeXAfk2AB2XgQ9is5FWjR1M2r/zS vZZha5b6T9SVsN4557fs0DiCh4eZQi5UtYv0bwBQoKkHhAOrHn5/nB2iXZeh/lpuOpZtKk 0kDIPAtQDvclj23W2TurS/clY3gcvlI= Received: from mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-196-YvqObOyDPT675tMG43FfYA-1; Thu, 11 Sep 2025 19:06:23 -0400 X-MC-Unique: YvqObOyDPT675tMG43FfYA-1 X-Mimecast-MFC-AGG-ID: YvqObOyDPT675tMG43FfYA_1757631982 Received: from mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.111]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id A17BF1955EA4; Thu, 11 Sep 2025 23:06:21 +0000 (UTC) Received: from warthog.procyon.org.uk (unknown [10.42.28.6]) by mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 97BF51800451; Thu, 11 Sep 2025 23:06:18 +0000 (UTC) Organization: Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 3798903 From: David Howells To: Dan Carpenter , netdev@vger.kernel.org cc: dhowells@redhat.com, Marc Dionne , Jakub Kicinski , "David S. Miller" , Eric Dumazet , Paolo Abeni , Simon Horman , linux-afs@lists.infradead.org, linux-kernel@vger.kernel.org Subject: [PATCH net] rxrpc: Fix untrusted unsigned subtract Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-ID: <2039267.1757631977.1@warthog.procyon.org.uk> Content-Transfer-Encoding: quoted-printable Date: Fri, 12 Sep 2025 00:06:17 +0100 Message-ID: <2039268.1757631977@warthog.procyon.org.uk> X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.111 Content-Type: text/plain; charset="utf-8" Fix the following Smatch Smatch static checker warning: net/rxrpc/rxgk_app.c:65 rxgk_yfs_decode_ticket() warn: untrusted unsigned subtract. 'ticket_len - 10 * 4' by prechecking the length of what we're trying to extract in two places in the token and decoding for a response packet. Also use sizeof() on the struct we're extracting rather specifying the size numerically to be consistent with the other related statements. Fixes: 9d1d2b59341f ("rxrpc: rxgk: Implement the yfs-rxgk security class (G= SSAPI)") Reported-by: Dan Carpenter Closes: https://lists.infradead.org/pipermail/linux-afs/2025-September/0101= 35.html Signed-off-by: David Howells cc: Marc Dionne cc: Jakub Kicinski cc: "David S. Miller" cc: Eric Dumazet cc: Paolo Abeni cc: Simon Horman cc: linux-afs@lists.infradead.org cc: netdev@vger.kernel.org Reviewed-by: Simon Horman --- net/rxrpc/rxgk_app.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/net/rxrpc/rxgk_app.c b/net/rxrpc/rxgk_app.c index df684b5a8531..30275cb5ba3e 100644 --- a/net/rxrpc/rxgk_app.c +++ b/net/rxrpc/rxgk_app.c @@ -54,6 +54,10 @@ int rxgk_yfs_decode_ticket(struct rxrpc_connection *conn= , struct sk_buff *skb, =20 _enter(""); =20 + if (ticket_len < 10 * sizeof(__be32)) + return rxrpc_abort_conn(conn, skb, RXGK_INCONSISTENCY, -EPROTO, + rxgk_abort_resp_short_yfs_tkt); + /* Get the session key length */ ret =3D skb_copy_bits(skb, ticket_offset, tmp, sizeof(tmp)); if (ret < 0) @@ -195,22 +199,23 @@ int rxgk_extract_token(struct rxrpc_connection *conn,= struct sk_buff *skb, __be32 token_len; } container; =20 + if (token_len < sizeof(container)) + goto short_packet; + /* Decode the RXGK_TokenContainer object. This tells us which server * key we should be using. We can then fetch the key, get the secret * and set up the crypto to extract the token. */ if (skb_copy_bits(skb, token_offset, &container, sizeof(container)) < 0) - return rxrpc_abort_conn(conn, skb, RXGK_PACKETSHORT, -EPROTO, - rxgk_abort_resp_tok_short); + goto short_packet; =20 kvno =3D ntohl(container.kvno); enctype =3D ntohl(container.enctype); ticket_len =3D ntohl(container.token_len); ticket_offset =3D token_offset + sizeof(container); =20 - if (xdr_round_up(ticket_len) > token_len - 3 * 4) - return rxrpc_abort_conn(conn, skb, RXGK_PACKETSHORT, -EPROTO, - rxgk_abort_resp_tok_short); + if (xdr_round_up(ticket_len) > token_len - sizeof(container)) + goto short_packet; =20 _debug("KVNO %u", kvno); _debug("ENC %u", enctype); @@ -285,4 +290,8 @@ int rxgk_extract_token(struct rxrpc_connection *conn, s= truct sk_buff *skb, * also come out this way if the ticket decryption fails. */ return ret; + +short_packet: + return rxrpc_abort_conn(conn, skb, RXGK_PACKETSHORT, -EPROTO, + rxgk_abort_resp_tok_short); }