Patch "rxrpc: Fix the ACK parser to extract the SACK table for parsing" has been added to the 6.6-stable tree

[gregkh at linuxfoundation.org]

This is a note to let you know that I've just added the patch titled

    rxrpc: Fix the ACK parser to extract the SACK table for parsing

to the 6.6-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     rxrpc-fix-the-ack-parser-to-extract-the-sack-table-for-parsing.patch
and it can be found in the queue-6.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable at vger.kernel.org> know about it.


>From stable+bounces-266877-greg=kroah.com at vger.kernel.org Wed Jun 17 19:04:21 2026
From: Sasha Levin <sashal at kernel.org>
Date: Wed, 17 Jun 2026 14:04:10 -0400
Subject: rxrpc: Fix the ACK parser to extract the SACK table for parsing
To: stable at vger.kernel.org
Cc: David Howells <dhowells at redhat.com>, Michael Bommarito <michael.bommarito at gmail.com>, Marc Dionne <marc.dionne at auristor.com>, Jeffrey Altman <jaltman at auristor.com>, Eric Dumazet <edumazet at google.com>, "David S. Miller" <davem at davemloft.net>, Jakub Kicinski <kuba at kernel.org>, Paolo Abeni <pabeni at redhat.com>, Simon Horman <horms at kernel.org>, linux-afs at lists.infradead.org, netdev at vger.kernel.org, stable at kernel.org, Sasha Levin <sashal at kernel.org>
Message-ID: <20260617180410.271223-1-sashal at kernel.org>

From: David Howells <dhowells at redhat.com>

[ Upstream commit 333b6d5bb9f87827ac2639c737bf9613dbae7253 ]

Fix modification of the received skbuff in rxrpc_input_soft_acks() and a
potential incorrect access of the buffer in a fragmented UDP packet (the
packet would probably have to be deliberately pre-generated as fragmented)
when AF_RXRPC tries to extract the contents of the SACK table by copying
out the contents of the SACK table into a buffer before attempting to parse

AF_RXRPC assumes that it can just call skb_condense() and then validly
access the SACK table from skb->data and that it will be a flat buffer -
but skb_condense() can silently fail to do anything under some
circumstances.

Note that whilst rxrpc_input_soft_acks() should be able to parse extended
ACKs, the rest of AF_RXRPC doesn't currently support that.

Further, there's then no need to call skb_condense() in rxrpc_input_ack(),
so don't.

Fixes: d57a3a151660 ("rxrpc: Save last ACK's SACK table rather than marking txbufs")
Reported-by: Michael Bommarito <michael.bommarito at gmail.com>
Link: https://lore.kernel.org/r/20260513180907.2061972-1-michael.bommarito@gmail.com
Signed-off-by: David Howells <dhowells at redhat.com>
cc: Marc Dionne <marc.dionne at auristor.com>
cc: Jeffrey Altman <jaltman at auristor.com>
cc: Eric Dumazet <edumazet at google.com>
cc: "David S. Miller" <davem at davemloft.net>
cc: Jakub Kicinski <kuba at kernel.org>
cc: Paolo Abeni <pabeni at redhat.com>
cc: Simon Horman <horms at kernel.org>
cc: linux-afs at lists.infradead.org
cc: netdev at vger.kernel.org
cc: stable at kernel.org
Link: https://patch.msgid.link/105362.1780573560@warthog.procyon.org.uk
Signed-off-by: Paolo Abeni <pabeni at redhat.com>
Signed-off-by: Sasha Levin <sashal at kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
---
 net/rxrpc/input.c |   13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

--- a/net/rxrpc/input.c
+++ b/net/rxrpc/input.c
@@ -781,7 +781,18 @@ static void rxrpc_input_soft_acks(struct
 	struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
 	unsigned int i, old_nacks = 0;
 	rxrpc_seq_t lowest_nak = seq + sp->nr_acks;
-	u8 *acks = skb->data + sizeof(struct rxrpc_wire_header) + sizeof(struct rxrpc_ackpacket);
+	u8 sack[256] __aligned(sizeof(unsigned long));
+	u8 *acks = sack;
+
+	/* Extract the SACK table into a flat buffer rather than accessing it
+	 * directly through skb->data, which is not guaranteed to be linear for
+	 * a fragmented packet (skb_condense() can silently fail to linearise
+	 * it).
+	 */
+	if (skb_copy_bits(skb,
+			  sizeof(struct rxrpc_wire_header) + sizeof(struct rxrpc_ackpacket),
+			  sack, umin(sp->nr_acks, sizeof(sack))) < 0)
+		return;
 
 	for (i = 0; i < sp->nr_acks; i++) {
 		if (acks[i] == RXRPC_ACK_TYPE_ACK) {


Patches currently in stable-queue which might be from sashal at kernel.org are

queue-6.6/selftests-bpf-add-test-to-ensure-kprobe_multi-is-not.patch
queue-6.6/debugobjects-do-not-fill_pool-if-pi_blocked_on.patch
queue-6.6/af_unix-reject-siocatmark-on-non-stream-sockets.patch
queue-6.6/bpf-track-equal-scalars-history-on-per-instruction-l.patch
queue-6.6/drm-amd-display-bound-vbios-record-chain-walk-loops.patch
queue-6.6/net-sched-fix-pedit-partial-cow-leading-to-page-cach.patch
queue-6.6/arm-fix-branch-predictor-hardening.patch
queue-6.6/phonet-pass-net-and-ifindex-to-phonet_address_notify.patch
queue-6.6/locking-rtmutex-skip-remove_waiter-when-waiter-is-not-enqueued.patch
queue-6.6/debugobjects-use-ld_wait_config-instead-of-ld_wait_s.patch
queue-6.6/arm-fix-hash_name-fault.patch
queue-6.6/slimbus-qcom-ngd-ctrl-balance-pm_runtime-enablement-for-ngd.patch
queue-6.6/drm-v3d-skip-csd-when-it-has-zeroed-workgroups.patch
queue-6.6/batman-adv-tt-prevent-tvlv-entry-number-overflow.patch
queue-6.6/fuse-limit-fuse_notify_retrieve-to-uptodate-folios.patch
queue-6.6/selftests-bpf-tests-for-per-insn-sync_linked_regs-pr.patch
queue-6.6/drivers-hv-vmbus-improve-the-logic-of-reserving-fb_mmio-on-gen2-vms.patch
queue-6.6/phonet-pass-ifindex-to-fill_addr.patch
queue-6.6/mptcp-pm-fix-extra_subflows-underflow-on-userspace-pm-subflow-creation.patch
queue-6.6/debugobjects-dont-call-fill_pool-in-early-boot-hardi.patch
queue-6.6/net-phonet-free-phonet_device-after-rcu-grace-period.patch
queue-6.6/futex-requeue-prevent-null-pointer-dereference-in-remove_waiter-on-self-deadlock.patch
queue-6.6/arm-group-is_permission_fault-with-is_translation_fa.patch
queue-6.6/slimbus-qcom-ngd-ctrl-fix-up-platform_driver-registration.patch
queue-6.6/ip6_vti-set-netns_immutable-on-the-fallback-device.patch
queue-6.6/rxrpc-fix-the-ack-parser-to-extract-the-sack-table-for-parsing.patch
queue-6.6/fuse-re-lock-request-before-replacing-page-cache-folio.patch
queue-6.6/selftests-bpf-update-comments-find_equal_scalars-syn.patch
queue-6.6/arm-allow-__do_kernel_fault-to-report-execution-of-m.patch
queue-6.6/bpf-remove-mark_precise_scalar_ids.patch
queue-6.6/hv-utils-handle-and-propagate-errors-in-kvp_register.patch
queue-6.6/kvm-vmx-update-svi-during-runtime-apicv-activation.patch
queue-6.6/ring-buffer-remove-ring_buffer_read_prepare_sync.patch
queue-6.6/debugobjects-allow-to-refill-the-pool-before-system_.patch
queue-6.6/bpf-reject-sleepable-kprobe_multi-programs-at-attach.patch
queue-6.6/drm-v3d-store-the-active-job-inside-the-queue-s-stat.patch