Patch "rxrpc: only handle RESPONSE during service challenge" has been added to the 6.12-stable tree

[gregkh at linuxfoundation.org]

This is a note to let you know that I've just added the patch titled

    rxrpc: only handle RESPONSE during service challenge

to the 6.12-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     rxrpc-only-handle-response-during-service-challenge.patch
and it can be found in the queue-6.12 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable at vger.kernel.org> know about it.


>From stable+bounces-237804-greg=kroah.com at vger.kernel.org Tue Apr 14 13:21:18 2026
From: Sasha Levin <sashal at kernel.org>
Date: Tue, 14 Apr 2026 07:21:03 -0400
Subject: rxrpc: only handle RESPONSE during service challenge
To: stable at vger.kernel.org
Cc: Wang Jie <jiewang2024 at lzu.edu.cn>, Yifan Wu <yifanwucs at gmail.com>, Juefei Pu <tomapufckgml at gmail.com>, Yuan Tan <yuantan098 at gmail.com>, Xin Liu <bird at lzu.edu.cn>, Yang Yang <n05ec at lzu.edu.cn>, David Howells <dhowells at redhat.com>, Marc Dionne <marc.dionne at auristor.com>, Jeffrey Altman <jaltman at auristor.com>, Simon Horman <horms at kernel.org>, linux-afs at lists.infradead.org, stable at kernel.org, Jakub Kicinski <kuba at kernel.org>, Sasha Levin <sashal at kernel.org>
Message-ID: <20260414112103.379483-2-sashal at kernel.org>

From: Wang Jie <jiewang2024 at lzu.edu.cn>

[ Upstream commit c43ffdcfdbb5567b1f143556df8a04b4eeea041c ]

Only process RESPONSE packets while the service connection is still in
RXRPC_CONN_SERVICE_CHALLENGING. Check that state under state_lock before
running response verification and security initialization, then use a local
secured flag to decide whether to queue the secured-connection work after
the state transition. This keeps duplicate or late RESPONSE packets from
re-running the setup path and removes the unlocked post-transition state
test.

Fixes: 17926a79320a ("[AF_RXRPC]: Provide secure RxRPC sockets for use by userspace and kernel both")
Reported-by: Yifan Wu <yifanwucs at gmail.com>
Reported-by: Juefei Pu <tomapufckgml at gmail.com>
Co-developed-by: Yuan Tan <yuantan098 at gmail.com>
Signed-off-by: Yuan Tan <yuantan098 at gmail.com>
Suggested-by: Xin Liu <bird at lzu.edu.cn>
Signed-off-by: Jie Wang <jiewang2024 at lzu.edu.cn>
Signed-off-by: Yang Yang <n05ec at lzu.edu.cn>
Signed-off-by: David Howells <dhowells at redhat.com>
cc: Marc Dionne <marc.dionne at auristor.com>
cc: Jeffrey Altman <jaltman at auristor.com>
cc: Simon Horman <horms at kernel.org>
cc: linux-afs at lists.infradead.org
cc: stable at kernel.org
Link: https://patch.msgid.link/20260408121252.2249051-21-dhowells@redhat.com
Signed-off-by: Jakub Kicinski <kuba at kernel.org>
[ adapted spin_lock_irq/spin_unlock_irq calls to spin_lock/spin_unlock ]
Signed-off-by: Sasha Levin <sashal at kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
---
 net/rxrpc/conn_event.c |   14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

--- a/net/rxrpc/conn_event.c
+++ b/net/rxrpc/conn_event.c
@@ -233,6 +233,7 @@ static int rxrpc_process_event(struct rx
 			       struct sk_buff *skb)
 {
 	struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
+	bool secured = false;
 	int ret;
 
 	if (conn->state == RXRPC_CONN_ABORTED)
@@ -245,6 +246,13 @@ static int rxrpc_process_event(struct rx
 		return conn->security->respond_to_challenge(conn, skb);
 
 	case RXRPC_PACKET_TYPE_RESPONSE:
+		spin_lock(&conn->state_lock);
+		if (conn->state != RXRPC_CONN_SERVICE_CHALLENGING) {
+			spin_unlock(&conn->state_lock);
+			return 0;
+		}
+		spin_unlock(&conn->state_lock);
+
 		ret = conn->security->verify_response(conn, skb);
 		if (ret < 0)
 			return ret;
@@ -255,11 +263,13 @@ static int rxrpc_process_event(struct rx
 			return ret;
 
 		spin_lock(&conn->state_lock);
-		if (conn->state == RXRPC_CONN_SERVICE_CHALLENGING)
+		if (conn->state == RXRPC_CONN_SERVICE_CHALLENGING) {
 			conn->state = RXRPC_CONN_SERVICE;
+			secured = true;
+		}
 		spin_unlock(&conn->state_lock);
 
-		if (conn->state == RXRPC_CONN_SERVICE) {
+		if (secured) {
 			/* Offload call state flipping to the I/O thread.  As
 			 * we've already received the packet, put it on the
 			 * front of the queue.


Patches currently in stable-queue which might be from sashal at kernel.org are

queue-6.12/rust-warn-on-bindgen-0.69.5-and-libclang-19.1.patch
queue-6.12/ima-do-not-copy-measurement-list-to-kdump-kernel.patch
queue-6.12/pci-endpoint-pci-epf-vntb-remove-duplicate-resource-.patch
queue-6.12/wifi-mac80211-always-free-skb-on-ieee80211_tx_prepar.patch
queue-6.12/net-ethernet-mtk_eth_soc-initialize-ppe-per-tag-laye.patch
queue-6.12/scripts-generate_rust_analyzer.py-define-scripts.patch
queue-6.12/ksmbd-fix-use-after-free-in-__ksmbd_close_fd-via-durable-scavenger.patch
queue-6.12/ima-verify-if-the-segment-size-has-changed.patch
queue-6.12/mm-pagewalk-fix-race-between-concurrent-split-and-refault.patch
queue-6.12/scripts-dtc-remove-unused-dts_version-in-dtc-lexer.l.patch
queue-6.12/rxrpc-only-handle-response-during-service-challenge.patch
queue-6.12/mm-userfaultfd-fix-hugetlb-fault-mutex-hash-calculat.patch