Patch "rxrpc: Fix anonymous key handling" has been added to the 6.1-stable tree

[gregkh at linuxfoundation.org]

This is a note to let you know that I've just added the patch titled

    rxrpc: Fix anonymous key handling

to the 6.1-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     rxrpc-fix-anonymous-key-handling.patch
and it can be found in the queue-6.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable at vger.kernel.org> know about it.


>From stable+bounces-237687-greg=kroah.com at vger.kernel.org Tue Apr 14 02:39:44 2026
From: Sasha Levin <sashal at kernel.org>
Date: Mon, 13 Apr 2026 20:29:44 -0400
Subject: rxrpc: Fix anonymous key handling
To: stable at vger.kernel.org
Cc: David Howells <dhowells at redhat.com>, Marc Dionne <marc.dionne at auristor.com>, Jeffrey Altman <jaltman at auristor.com>, Simon Horman <horms at kernel.org>, linux-afs at lists.infradead.org, stable at kernel.org, Jakub Kicinski <kuba at kernel.org>, Sasha Levin <sashal at kernel.org>
Message-ID: <20260414002944.3802386-1-sashal at kernel.org>

From: David Howells <dhowells at redhat.com>

[ Upstream commit 6a59d84b4fc2f27f7b40e348506cc686712e260b ]

In rxrpc_new_client_call_for_sendmsg(), a key with no payload is meant to
be substituted for a NULL key pointer, but the variable this is done with
is subsequently not used.

Fix this by using "key" rather than "rx->key" when filling in the
connection parameters.

Note that this only affects direct use of AF_RXRPC; the kAFS filesystem
doesn't use sendmsg() directly and so bypasses the issue.  Further,
AF_RXRPC passes a NULL key in if no key is set, so using an anonymous key
in that manner works.  Since this hasn't been noticed to this point, it
might be better just to remove the "key" variable and the code that sets it
- and, arguably, rxrpc_init_client_call_security() would be a better place
to handle it.

Fixes: 19ffa01c9c45 ("rxrpc: Use structs to hold connection params and protocol info")
Closes: https://sashiko.dev/#/patchset/20260319150150.4189381-1-dhowells%40redhat.com
Signed-off-by: David Howells <dhowells at redhat.com>
cc: Marc Dionne <marc.dionne at auristor.com>
cc: Jeffrey Altman <jaltman at auristor.com>
cc: Simon Horman <horms at kernel.org>
cc: linux-afs at lists.infradead.org
cc: stable at kernel.org
Link: https://patch.msgid.link/20260408121252.2249051-4-dhowells@redhat.com
Signed-off-by: Jakub Kicinski <kuba at kernel.org>
Signed-off-by: Sasha Levin <sashal at kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
---
 net/rxrpc/sendmsg.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/net/rxrpc/sendmsg.c
+++ b/net/rxrpc/sendmsg.c
@@ -624,7 +624,7 @@ rxrpc_new_client_call_for_sendmsg(struct
 
 	memset(&cp, 0, sizeof(cp));
 	cp.local		= rx->local;
-	cp.key			= rx->key;
+	cp.key			= key;
 	cp.security_level	= rx->min_sec_level;
 	cp.exclusive		= rx->exclusive | p->exclusive;
 	cp.upgrade		= p->upgrade;


Patches currently in stable-queue which might be from sashal at kernel.org are

queue-6.1/dt-bindings-net-fix-tegra234-mgbe-ptp-clock.patch
queue-6.1/e1000-check-return-value-of-e1000_read_eeprom.patch
queue-6.1/netfilter-ip6t_eui64-reject-invalid-mac-header-for-a.patch
queue-6.1/wifi-wl1251-validate-packet-ids-before-indexing-tx_f.patch
queue-6.1/alsa-hda-realtek-add-hp-envy-laptop-13-ba0xxx-quirk.patch
queue-6.1/alsa-hda-realtek-add-mute-led-quirk-for-hp-pavilion-.patch
queue-6.1/hid-roccat-fix-use-after-free-in-roccat_report_event.patch
queue-6.1/revert-net-ixp4xx_eth-convert-to-ndo_hwtstamp_get-an.patch
queue-6.1/nf_tables-nft_dynset-fix-possible-stateful-expressio.patch
queue-6.1/asoc-stm32_sai-fix-incorrect-bclk-polarity-for-dsp_a.patch
queue-6.1/ata-ahci-force-32-bit-dma-for-jmicron-jmb582-jmb585.patch
queue-6.1/arm64-dts-imx8mq-set-the-correct-gpu_ahb-clock-frequ.patch
queue-6.1/net-sched-act_csum-validate-nested-vlan-headers.patch
queue-6.1/rxrpc-proc-size-address-buffers-for-pispc-output.patch
queue-6.1/revert-net-ethernet-xscale-check-for-ptp-support-pro.patch
queue-6.1/bonding-check-xdp-prog-when-set-bond-mode.patch
queue-6.1/drm-vc4-fix-memory-leak-of-bo-array-in-hang-state.patch
queue-6.1/pci-endpoint-pci-epf-vntb-stop-cmd_handler-work-in-epf_ntb_epc_cleanup.patch
queue-6.1/rxrpc-reject-undecryptable-rxkad-response-tickets.patch
queue-6.1/bonding-return-detailed-error-when-loading-native-xd.patch
queue-6.1/can-mcp251x-add-error-handling-for-power-enable-in-o.patch
queue-6.1/asoc-qcom-q6apm-move-component-registration-to-unmanaged-version.patch
queue-6.1/nfc-s3fwrn5-allocate-rx-skb-before-consuming-bytes.patch
queue-6.1/alsa-usb-audio-fix-quirk-flags-for-neuraldsp-quad-co.patch
queue-6.1/ocfs2-validate-inline-data-i_size-during-inode-read.patch
queue-6.1/drm-vc4-fix-a-memory-leak-in-hang-state-error-path.patch
queue-6.1/revert-dmaengine-idxd-fix-not-releasing-workqueue-on.patch
queue-6.1/btrfs-tracepoints-get-correct-superblock-from-dentry.patch
queue-6.1/checkpatch-add-support-for-assisted-by-tag.patch
queue-6.1/arm64-dts-imx8mq-librem5-set-the-dvs-voltages-lower.patch
queue-6.1/pci-endpoint-pci-epf-vntb-remove-duplicate-resource-.patch
queue-6.1/soc-aspeed-socinfo-mask-table-entries-for-accurate-s.patch
queue-6.1/ixgbevf-add-missing-negotiate_features-op-to-hyper-v.patch
queue-6.1/revert-drm-fix-use-after-free-on-framebuffers-and-pr.patch
queue-6.1/arm64-dts-imx8mq-librem5-bump-buck1-suspend-voltage-up-to-0.85v.patch
queue-6.1/wifi-mac80211-always-free-skb-on-ieee80211_tx_prepar.patch
queue-6.1/net-add-proper-rcu-protection-to-proc-net-ptype.patch
queue-6.1/l2tp-drop-large-packets-with-udp-encap.patch
queue-6.1/asoc-amd-yc-add-dmi-quirk-for-asus-expertbook-bm1403.patch
queue-6.1/asoc-sof-topology-reject-invalid-vendor-array-size-i.patch
queue-6.1/net-dsa-clean-up-fdb-mdb-vlan-entries-on-unbind.patch
queue-6.1/selftests-net-bridge_vlan_mcast-wait-for-h1-before-q.patch
queue-6.1/gpio-tegra-fix-irq_release_resources-calling-enable-.patch
queue-6.1/rxrpc-fix-anonymous-key-handling.patch
queue-6.1/wifi-brcmfmac-validate-bsscfg-indices-in-if-events.patch
queue-6.1/asoc-amd-yc-add-dmi-quirk-for-thin-a15-b7vf.patch
queue-6.1/media-rkvdec-reduce-stack-usage-in-rkvdec_init_v4l2_.patch
queue-6.1/scripts-generate_rust_analyzer.py-define-scripts.patch
queue-6.1/xfrm_user-fix-info-leak-in-build_mapping.patch
queue-6.1/fs-smb-client-fix-out-of-bounds-read-in-cifs_sanitiz.patch
queue-6.1/alsa-asihpi-avoid-write-overflow-check-warning.patch
queue-6.1/perf-x86-intel-uncore-skip-discovery-table-for-offli.patch
queue-6.1/rxrpc-fix-call-removal-to-use-rcu-safe-deletion.patch
queue-6.1/asoc-amd-yc-add-dmi-entry-for-hp-laptop-15-fc0xxx.patch
queue-6.1/crypto-algif_aead-fix-minimum-rx-size-check-for-decr.patch
queue-6.1/asoc-soc-core-call-missing-init_list_head-for-card_a.patch
queue-6.1/net-lapbether-handle-netdev_pre_type_change.patch
queue-6.1/ocfs2-add-inline-inode-consistency-check-to-ocfs2_validate_inode_block.patch
queue-6.1/ipv6-add-null-checks-for-idev-in-srv6-paths.patch
queue-6.1/drm-i915-psr-do-not-use-pipe_src-as-borders-for-su-a.patch
queue-6.1/rxrpc-fix-key-quota-calculation-for-multitoken-keys.patch
queue-6.1/netfilter-conntrack-add-missing-netlink-policy-valid.patch
queue-6.1/pinctrl-intel-fix-the-revision-for-new-features-1koh.patch
queue-6.1/af_unix-read-unix_diag_vfs-data-under-unix_state_loc.patch
queue-6.1/eventpoll-defer-struct-eventpoll-free-to-rcu-grace-p.patch
queue-6.1/drm-vc4-protect-madv-read-in-vc4_gem_object_mmap-wit.patch
queue-6.1/alsa-hda-realtek-add-quirk-for-lenovo-yoga-pro-7-14i.patch
queue-6.1/xfrm-wait-for-rcu-readers-during-policy-netns-exit.patch
queue-6.1/netfilter-xt_multiport-validate-range-encoding-in-ch.patch
queue-6.1/gfs2-improve-gfs2_consist_inode-usage.patch
queue-6.1/netfilter-nft_set_pipapo_avx2-don-t-return-non-match.patch
queue-6.1/scripts-dtc-remove-unused-dts_version-in-dtc-lexer.l.patch
queue-6.1/alsa-hda-realtek-add-quirk-for-framework-f111-000f.patch
queue-6.1/drm-amdgpu-remove-two-invalid-bug_on-s.patch
queue-6.1/pci-hv-set-default-numa-node-to-0-for-devices-withou.patch
queue-6.1/xsk-tighten-umem-headroom-validation-to-account-for-.patch
queue-6.1/alsa-usb-audio-improve-focusrite-sample-rate-filteri.patch
queue-6.1/scsi-ufs-core-fix-use-after-free-in-init-error-and-remove-paths.patch
queue-6.1/revert-arm64-dts-imx8mq-librem5-set-the-dvs-voltages-lower.patch
queue-6.1/drm-vc4-release-runtime-pm-reference-after-binding-v.patch
queue-6.1/net-sched-fix-tcf_layer_transport-handling-in-tcf_ge.patch
queue-6.1/ublk-fix-deadlock-when-reading-partition-table.patch
queue-6.1/alsa-usb-audio-fix-race-condition-to-uaf-in-snd_usbm.patch
queue-6.1/soc-qcom-apr-make-remove-callback-of-apr-driver-void-returned.patch
queue-6.1/gfs2-validate-i_depth-for-exhash-directories.patch
queue-6.1/netfilter-nfnetlink_log-initialize-nfgenmsg-in-nlmsg.patch
queue-6.1/kvm-x86-use-__declare_flex_array-for-uapi-structures-with-vlas.patch
queue-6.1/arm64-dts-imx8mq-librem5-bump-buck1-suspend-voltage-to-0.81v.patch
queue-6.1/epoll-use-refcount-to-reduce-ep_mutex-contention.patch
queue-6.1/ocfs2-fix-out-of-bounds-write-in-ocfs2_write_end_inline.patch
queue-6.1/rxrpc-only-handle-response-during-service-challenge.patch
queue-6.1/tracing-probe-reject-non-closed-empty-immediate-stri.patch
queue-6.1/hid-quirks-add-hid_quirk_always_poll-for-8bitdo-pro-.patch
queue-6.1/ipv4-icmp-fix-null-ptr-deref-in-icmp_build_probe.patch