Patch "rxrpc: Fix the ACK parser to extract the SACK table for parsing" has been added to the 6.12-stable tree

[gregkh at linuxfoundation.org]

This is a note to let you know that I've just added the patch titled

    rxrpc: Fix the ACK parser to extract the SACK table for parsing

to the 6.12-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     rxrpc-fix-the-ack-parser-to-extract-the-sack-table-for-parsing.patch
and it can be found in the queue-6.12 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable at vger.kernel.org> know about it.


>From stable+bounces-266865-greg=kroah.com at vger.kernel.org Wed Jun 17 18:21:35 2026
From: Sasha Levin <sashal at kernel.org>
Date: Wed, 17 Jun 2026 13:21:26 -0400
Subject: rxrpc: Fix the ACK parser to extract the SACK table for parsing
To: stable at vger.kernel.org
Cc: David Howells <dhowells at redhat.com>, Michael Bommarito <michael.bommarito at gmail.com>, Marc Dionne <marc.dionne at auristor.com>, Jeffrey Altman <jaltman at auristor.com>, Eric Dumazet <edumazet at google.com>, "David S. Miller" <davem at davemloft.net>, Jakub Kicinski <kuba at kernel.org>, Paolo Abeni <pabeni at redhat.com>, Simon Horman <horms at kernel.org>, linux-afs at lists.infradead.org, netdev at vger.kernel.org, stable at kernel.org, Sasha Levin <sashal at kernel.org>
Message-ID: <20260617172126.254222-1-sashal at kernel.org>

From: David Howells <dhowells at redhat.com>

[ Upstream commit 333b6d5bb9f87827ac2639c737bf9613dbae7253 ]

Fix modification of the received skbuff in rxrpc_input_soft_acks() and a
potential incorrect access of the buffer in a fragmented UDP packet (the
packet would probably have to be deliberately pre-generated as fragmented)
when AF_RXRPC tries to extract the contents of the SACK table by copying
out the contents of the SACK table into a buffer before attempting to parse

AF_RXRPC assumes that it can just call skb_condense() and then validly
access the SACK table from skb->data and that it will be a flat buffer -
but skb_condense() can silently fail to do anything under some
circumstances.

Note that whilst rxrpc_input_soft_acks() should be able to parse extended
ACKs, the rest of AF_RXRPC doesn't currently support that.

Further, there's then no need to call skb_condense() in rxrpc_input_ack(),
so don't.

Fixes: d57a3a151660 ("rxrpc: Save last ACK's SACK table rather than marking txbufs")
Reported-by: Michael Bommarito <michael.bommarito at gmail.com>
Link: https://lore.kernel.org/r/20260513180907.2061972-1-michael.bommarito@gmail.com
Signed-off-by: David Howells <dhowells at redhat.com>
cc: Marc Dionne <marc.dionne at auristor.com>
cc: Jeffrey Altman <jaltman at auristor.com>
cc: Eric Dumazet <edumazet at google.com>
cc: "David S. Miller" <davem at davemloft.net>
cc: Jakub Kicinski <kuba at kernel.org>
cc: Paolo Abeni <pabeni at redhat.com>
cc: Simon Horman <horms at kernel.org>
cc: linux-afs at lists.infradead.org
cc: netdev at vger.kernel.org
cc: stable at kernel.org
Link: https://patch.msgid.link/105362.1780573560@warthog.procyon.org.uk
Signed-off-by: Paolo Abeni <pabeni at redhat.com>
Signed-off-by: Sasha Levin <sashal at kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
---
 net/rxrpc/input.c |   21 ++++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

--- a/net/rxrpc/input.c
+++ b/net/rxrpc/input.c
@@ -775,9 +775,23 @@ static void rxrpc_input_soft_acks(struct
 				  rxrpc_seq_t since)
 {
 	struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
-	unsigned int i, old_nacks = 0;
+	unsigned int i, old_nacks = 0, nsack;
 	rxrpc_seq_t lowest_nak = seq + sp->ack.nr_acks;
-	u8 *acks = skb->data + sizeof(struct rxrpc_wire_header) + sizeof(struct rxrpc_ackpacket);
+	u8 sack[256] __aligned(sizeof(unsigned long));
+	u8 *acks = sack;
+
+	/* AF_RXRPC assumes that it can access the SACK table directly from
+	 * skb->data as a flat buffer, but the skb may be non-linear (e.g. a
+	 * fragmented UDP packet) and skb_condense() can silently fail to
+	 * linearise it.  Copy the SACK table out into a local buffer before
+	 * parsing it.
+	 */
+	memset(sack, 0, sizeof(sack));
+	nsack = umin(sp->ack.nr_acks, 256);
+	if (skb_copy_bits(skb,
+			  sizeof(struct rxrpc_wire_header) + sizeof(struct rxrpc_ackpacket),
+			  sack, nsack) < 0)
+		return;
 
 	for (i = 0; i < sp->ack.nr_acks; i++) {
 		if (acks[i] == RXRPC_ACK_TYPE_ACK) {
@@ -934,9 +948,6 @@ static void rxrpc_input_ack(struct rxrpc
 	    skb_copy_bits(skb, ioffset, &trailer, sizeof(trailer)) < 0)
 		return rxrpc_proto_abort(call, 0, rxrpc_badmsg_short_ack_trailer);
 
-	if (nr_acks > 0)
-		skb_condense(skb);
-
 	if (call->cong_last_nack) {
 		since = rxrpc_input_check_prev_ack(call, &summary, first_soft_ack);
 		rxrpc_free_skb(call->cong_last_nack, rxrpc_skb_put_last_nack);


Patches currently in stable-queue which might be from sashal at kernel.org are

queue-6.12/bonding-fix-null-pointer-dereference-in-actor_port_prio-setting.patch
queue-6.12/selftests-bpf-add-test-to-ensure-kprobe_multi-is-not.patch
queue-6.12/wifi-mt76-mt7921-fix-a-potential-scan-no-aps.patch
queue-6.12/staging-rtl8723bs-fix-buffer-over-read-in-rtw_update_protection.patch
queue-6.12/eventpoll-move-epi_fget-up.patch
queue-6.12/debugobjects-do-not-fill_pool-if-pi_blocked_on.patch
queue-6.12/eventpoll-drop-vestigial-__-prefix-from-ep_remove_-f.patch
queue-6.12/acpi-scan-use-async-schedule-function-in-acpi_scan_c.patch
queue-6.12/net-bonding-add-broadcast_neighbor-option-for-802.3ad.patch
queue-6.12/eventpoll-rename-ep_remove_safe-back-to-ep_remove.patch
queue-6.12/fhandle-fix-uaf-due-to-unlocked-mnt_ns-read-in-may_decode_fh.patch
queue-6.12/bonding-3ad-implement-proper-rcu-rules-for-port-aggregator.patch
queue-6.12/net-drop-the-lock-in-skb_may_tx_timestamp.patch
queue-6.12/phonet-pass-net-and-ifindex-to-phonet_address_notify.patch
queue-6.12/locking-rtmutex-skip-remove_waiter-when-waiter-is-not-enqueued.patch
queue-6.12/debugobjects-use-ld_wait_config-instead-of-ld_wait_s.patch
queue-6.12/drm-xe-display-fix-oops-in-suspend-shutdown-without-.patch
queue-6.12/drm-v3d-skip-csd-when-it-has-zeroed-workgroups.patch
queue-6.12/gpiolib-extract-gpiochip_choose_fwnode-for-wider-use.patch
queue-6.12/gpio-fix-resource-leaks-on-errors-in-gpiochip_add_da.patch
queue-6.12/gpiolib-remove-redundant-assignment-of-return-variab.patch
queue-6.12/fuse-limit-fuse_notify_retrieve-to-uptodate-folios.patch
queue-6.12/drivers-hv-vmbus-improve-the-logic-of-reserving-fb_mmio-on-gen2-vms.patch
queue-6.12/io_uring-net-avoid-msghdr-on-op_connect-op_bind-asyn.patch
queue-6.12/phonet-pass-ifindex-to-fill_addr.patch
queue-6.12/eventpoll-kill-__ep_remove.patch
queue-6.12/debugobjects-dont-call-fill_pool-in-early-boot-hardi.patch
queue-6.12/net-phonet-free-phonet_device-after-rcu-grace-period.patch
queue-6.12/xfs-remove-the-expr-argument-to-xfs_test_error.patch
queue-6.12/futex-requeue-prevent-null-pointer-dereference-in-remove_waiter-on-self-deadlock.patch
queue-6.12/bonding-add-support-for-per-port-lacp-actor-priority.patch
queue-6.12/wifi-mt76-mt7921-fix-potential-deadlock-in-mt7921_ro.patch
queue-6.12/bonding-print-churn-state-via-netlink.patch
queue-6.12/eventpoll-fix-ep_remove-struct-eventpoll-struct-file.patch
queue-6.12/ip6_vti-set-netns_immutable-on-the-fallback-device.patch
queue-6.12/eventpoll-split-__ep_remove.patch
queue-6.12/rxrpc-fix-the-ack-parser-to-extract-the-sack-table-for-parsing.patch
queue-6.12/locking-mutex-remove-wakeups-from-under-mutex-wait_lock.patch
queue-6.12/fuse-re-lock-request-before-replacing-page-cache-folio.patch
queue-6.12/revert-net-bonding-fix-use-after-free-in-bond_xmit_broadcast.patch
queue-6.12/hv-utils-handle-and-propagate-errors-in-kvp_register.patch
queue-6.12/iio-light-bh1780-fix-pm-runtime-leak-on-error-path.patch
queue-6.12/eventpoll-use-hlist_is_singular_node-in-__ep_remove.patch
queue-6.12/xfs-fix-error-returns-in-cow-fork-repair.patch
queue-6.12/debugobjects-allow-to-refill-the-pool-before-system_.patch
queue-6.12/reapply-selftest-ptp-update-ptp-selftest-to-exercise-the-gettimex-options.patch
queue-6.12/wifi-mt76-mt7921-avoid-undesired-changes-of-the-pres.patch
queue-6.12/bpf-reject-sleepable-kprobe_multi-programs-at-attach.patch
queue-6.12/net-bonding-fix-use-after-free-in-bond_xmit_broadcast.patch
queue-6.12/drm-v3d-store-the-active-job-inside-the-queue-s-stat.patch