Patch "rxrpc: Fix the reception of a reply packet before data transmission" has been added to the 6.18-stable tree

[gregkh at linuxfoundation.org]

This is a note to let you know that I've just added the patch titled

    rxrpc: Fix the reception of a reply packet before data transmission

to the 6.18-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     rxrpc-fix-the-reception-of-a-reply-packet-before-data-transmission.patch
and it can be found in the queue-6.18 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable at vger.kernel.org> know about it.


>From a58e33405acd2584e730c1da72635f822ada6b49 Mon Sep 17 00:00:00 2001
From: David Howells <dhowells at redhat.com>
Date: Wed, 24 Jun 2026 17:38:13 +0100
Subject: rxrpc: Fix the reception of a reply packet before data transmission

From: David Howells <dhowells at redhat.com>

commit a58e33405acd2584e730c1da72635f822ada6b49 upstream.

Fix rxrpc_receiving_reply() to handle the reception of an apparent reply
DATA packet before rxrpc has had a chance to send any request DATA packets
on a client call by checking to see if the call has been exposed yet by
sending the first packet.

Without this, rxrpc_rotate_tx_window() might oops.

Also fix rxrpc_rotate_tx_window() to handle the Tx queue being empty by
changing the do...while loop into a while loop, just in case a call is
abnormally terminated by an early reply before the last request packet is
transmitted.

Fixes: b341a0263b1b ("rxrpc: Implement progressive transmission queue struct")
Link: https://sashiko.dev/#/patchset/20260616155749.2125907-1-dhowells%40redhat.com
Signed-off-by: David Howells <dhowells at redhat.com>
cc: Marc Dionne <marc.dionne at auristor.com>
cc: Jeffrey Altman <jaltman at auristor.com>
cc: Simon Horman <horms at kernel.org>
cc: linux-afs at lists.infradead.org
cc: stable at kernel.org
Link: https://patch.msgid.link/20260624163819.3017002-7-dhowells@redhat.com
Signed-off-by: Jakub Kicinski <kuba at kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
---
 net/rxrpc/input.c |   13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

--- a/net/rxrpc/input.c
+++ b/net/rxrpc/input.c
@@ -251,7 +251,7 @@ static bool rxrpc_rotate_tx_window(struc
 		tq = call->tx_queue;
 	}
 
-	do {
+	while (before_eq(seq, to)) {
 		unsigned int ix = seq - call->tx_qbase;
 
 		_debug("tq=%x seq=%x i=%d f=%x", tq->qbase, seq, ix, tq->bufs[ix]->flags);
@@ -321,8 +321,7 @@ static bool rxrpc_rotate_tx_window(struc
 				break;
 			}
 		}
-
-	} while (before_eq(seq, to));
+	}
 
 	if (trace)
 		trace_rxrpc_rack_update(call, summary);
@@ -397,6 +396,14 @@ static bool rxrpc_receiving_reply(struct
 		trace_rxrpc_timer_can(call, rxrpc_timer_trace_delayed_ack);
 	}
 
+	/* Deal with an apparent reply coming in before we've got the request
+	 * queued or transmitted.
+	 */
+	if (!test_bit(RXRPC_CALL_EXPOSED, &call->flags)) {
+		rxrpc_proto_abort(call, top, rxrpc_eproto_early_reply);
+		return false;
+	}
+
 	if (!test_bit(RXRPC_CALL_TX_LAST, &call->flags)) {
 		if (!rxrpc_rotate_tx_window(call, top, &summary)) {
 			rxrpc_proto_abort(call, top, rxrpc_eproto_early_reply);


Patches currently in stable-queue which might be from dhowells at redhat.com are

queue-6.18/rxrpc-don-t-move-a-peeked-oob-message-onto-the-pending-queue.patch
queue-6.18/rxrpc-fix-potential-infinite-loop-in-rxrpc_recvmsg.patch
queue-6.18/rxrpc-rxrpc_verify_data-ensure-rx_dec_buffer-alloc.patch
queue-6.18/afs-fix-further-netns-teardown-to-cancel-the-preallocation-charger.patch
queue-6.18/afs-fix-netns-teardown-to-cancel-the-preallocation-charger.patch
queue-6.18/rxrpc-fix-ackall-packet-handling.patch
queue-6.18/rxrpc-fix-leak-of-connection-from-oob-challenge.patch
queue-6.18/rxrpc-fix-oob-challenge-leak-in-cleanup-after-notification-failure.patch
queue-6.18/afs-handle-cb.initcallbackstate3-requests-without-a-server-record.patch
queue-6.18/rxrpc-fix-socket-notification-race.patch
queue-6.18/rxrpc-fix-rxrpc_rotate_tx_rotate-to-check-there-s-something-to-rotate.patch
queue-6.18/rxrpc-fix-leak-of-released-call-in-recvmsg-msg_peek.patch
queue-6.18/rxrpc-serialize-kernel-accept-preallocation-with-socket-teardown.patch
queue-6.18/afs-fix-null-pointer-dereference-in-afs_get_tree.patch
queue-6.18/rxrpc-fix-the-reception-of-a-reply-packet-before-data-transmission.patch
queue-6.18/rxrpc-fix-double-unlock-in-rxrpc_recvmsg.patch
queue-6.18/afs-fix-uncancelled-rxrpc-oob-message-handler.patch
queue-6.18/rxrpc-fix-uaf-in-rxgk_issue_challenge.patch