Patch "rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc" has been added to the 6.6-stable tree

[gregkh at linuxfoundation.org]

This is a note to let you know that I've just added the patch titled

    rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc

to the 6.6-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     rxrpc-rxrpc_verify_data-ensure-rx_dec_buffer-alloc.patch
and it can be found in the queue-6.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable at vger.kernel.org> know about it.


>From 16c8ae9735c5bd7e54dd7478d6348e0fc860842d Mon Sep 17 00:00:00 2001
From: Jeffrey Altman <jaltman at auristor.com>
Date: Tue, 9 Jun 2026 15:09:05 +0100
Subject: rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc

From: Jeffrey Altman <jaltman at auristor.com>

commit 16c8ae9735c5bd7e54dd7478d6348e0fc860842d upstream.

rxrpc_recvmsg_data() calls rxrpc_verify_data() whenever the
rxrpc_call.rx_dec_buffer is unallocated and assumes that upon
successful return that rx_dec_buffer must be allocated.
However, rxrpc_verify_data() does not request an allocation if
the rxrpc_skb_priv.len is zero.

In addition, failure to allocate rx_dec_buffer will result in a
call to skb_copy_bits() with a NULL destination which can
trigger a NULL pointer dereference.

To prevent these issues rxrpc_verify_data() is modified to
always attempt to allocate the rxrpc_call.rx_dec_buffer if it
is NULL.

This issue was identified with assistance of a private
sashiko instance.

Fixes: d2bc90cf6c75cb ("rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg")
Reported-by: Simon Horman <simon.horman at redhat.com>
Signed-off-by: Jeffrey Altman <jaltman at auristor.com>
Signed-off-by: David Howells <dhowells at redhat.com>
cc: Jiayuan Chen <jiayuan.chen at linux.dev>
cc: Marc Dionne <marc.dionne at auristor.com>
cc: linux-afs at lists.infradead.org
cc: stable at kernel.org
Link: https://patch.msgid.link/20260609140911.838677-2-dhowells@redhat.com
Signed-off-by: Jakub Kicinski <kuba at kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
---
 net/rxrpc/recvmsg.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/net/rxrpc/recvmsg.c
+++ b/net/rxrpc/recvmsg.c
@@ -157,7 +157,7 @@ static int rxrpc_verify_data(struct rxrp
 	struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
 	int ret;
 
-	if (sp->len > call->rx_dec_bsize) {
+	if (sp->len > call->rx_dec_bsize || !call->rx_dec_buffer) {
 		/* Make sure we can hold a 1412-byte jumbo subpacket and make
 		 * sure that the buffer size is aligned to a crypto blocksize.
 		 */


Patches currently in stable-queue which might be from jaltman at auristor.com are

queue-6.6/rxrpc-rxrpc_verify_data-ensure-rx_dec_buffer-alloc.patch
queue-6.6/afs-fix-further-netns-teardown-to-cancel-the-preallocation-charger.patch
queue-6.6/afs-fix-netns-teardown-to-cancel-the-preallocation-charger.patch
queue-6.6/rxrpc-fix-leak-of-released-call-in-recvmsg-msg_peek.patch