Patch "rxrpc: Fix integer overflow in rxgk_verify_response()" has been added to the 6.19-stable tree

[gregkh at linuxfoundation.org]

This is a note to let you know that I've just added the patch titled

    rxrpc: Fix integer overflow in rxgk_verify_response()

to the 6.19-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     rxrpc-fix-integer-overflow-in-rxgk_verify_response.patch
and it can be found in the queue-6.19 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable at vger.kernel.org> know about it.


>From 699e52180f4231c257821c037ed5c99d5eb0edb8 Mon Sep 17 00:00:00 2001
From: David Howells <dhowells at redhat.com>
Date: Wed, 8 Apr 2026 13:12:45 +0100
Subject: rxrpc: Fix integer overflow in rxgk_verify_response()

From: David Howells <dhowells at redhat.com>

commit 699e52180f4231c257821c037ed5c99d5eb0edb8 upstream.

In rxgk_verify_response(), there's a potential integer overflow due to
rounding up token_len before checking it, thereby allowing the length check to
be bypassed.

Fix this by checking the unrounded value against len too (len is limited as
the response must fit in a single UDP packet).

Fixes: 9d1d2b59341f ("rxrpc: rxgk: Implement the yfs-rxgk security class (GSSAPI)")
Closes: https://sashiko.dev/#/patchset/20260401105614.1696001-10-dhowells@redhat.com
Signed-off-by: David Howells <dhowells at redhat.com>
cc: Marc Dionne <marc.dionne at auristor.com>
cc: Jeffrey Altman <jaltman at auristor.com>
cc: Simon Horman <horms at kernel.org>
cc: linux-afs at lists.infradead.org
cc: stable at kernel.org
Link: https://patch.msgid.link/20260408121252.2249051-18-dhowells@redhat.com
Signed-off-by: Jakub Kicinski <kuba at kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
---
 net/rxrpc/rxgk.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/net/rxrpc/rxgk.c
+++ b/net/rxrpc/rxgk.c
@@ -1209,7 +1209,8 @@ static int rxgk_verify_response(struct r
 
 	token_offset	= offset;
 	token_len	= ntohl(rhdr.token_len);
-	if (xdr_round_up(token_len) + sizeof(__be32) > len)
+	if (token_len > len ||
+	    xdr_round_up(token_len) + sizeof(__be32) > len)
 		goto short_packet;
 
 	trace_rxrpc_rx_response(conn, sp->hdr.serial, 0, sp->hdr.cksum, token_len);


Patches currently in stable-queue which might be from dhowells at redhat.com are

queue-6.19/rxrpc-fix-rxgk-token-loading-to-check-bounds.patch
queue-6.19/rxrpc-only-put-the-call-ref-if-one-was-acquired.patch
queue-6.19/rxrpc-proc-size-address-buffers-for-pispc-output.patch
queue-6.19/rxrpc-fix-buffer-overread-in-rxgk_do_verify_authenticator.patch
queue-6.19/rxrpc-reject-undecryptable-rxkad-response-tickets.patch
queue-6.19/rxrpc-fix-missing-error-checks-for-rxkad-encryption-decryption-failure.patch
queue-6.19/rxrpc-fix-use-of-wrong-skb-when-comparing-queued-resp-challenge-serial.patch
queue-6.19/rxrpc-fix-integer-overflow-in-rxgk_verify_response.patch
queue-6.19/rxrpc-fix-reference-count-leak-in-rxrpc_server_keyring.patch
queue-6.19/rxrpc-fix-key-reference-count-leak-from-call-key.patch
queue-6.19/rxrpc-fix-leak-of-rxgk-context-in-rxgk_verify_response.patch
queue-6.19/rxrpc-fix-anonymous-key-handling.patch
queue-6.19/rxrpc-fix-to-request-an-ack-if-window-is-limited.patch
queue-6.19/rxrpc-fix-call-removal-to-use-rcu-safe-deletion.patch
queue-6.19/rxrpc-fix-key-quota-calculation-for-multitoken-keys.patch
queue-6.19/mm-filemap-fix-nr_pages-calculation-overflow-in-filemap_map_pages.patch
queue-6.19/rxrpc-fix-key-parsing-memleak.patch
queue-6.19/rxrpc-fix-rack-timer-warning-to-report-unexpected-mode.patch
queue-6.19/rxrpc-fix-response-authenticator-parser-oob-read.patch
queue-6.19/rxrpc-fix-key-keyring-checks-in-setsockopt-rxrpc_security_key-keyring.patch
queue-6.19/rxrpc-fix-oversized-response-authenticator-length-check.patch
queue-6.19/rxrpc-only-handle-response-during-service-challenge.patch