[PATCH net 1/1] rxrpc: fix null-security challenge leak

[Zhiling Zou]

none_validate_challenge() aborts a null-security connection but returns
true. rxrpc_input_conn_packet() then queues the CHALLENGE and takes an
extra connection reference. When the connection worker handles the
packet, rxrpc_process_event() sees the aborted state and returns before
releasing that reference.

Return false after aborting the connection so the CHALLENGE is not
queued and the extra reference is not taken.

Fixes: 5800b1cf3fd8 ("rxrpc: Allow CHALLENGEs to the passed to the app for a RESPONSE")
Cc: stable at vger.kernel.org
Reported-by: Vega <vega at nebusec.ai>
Assisted-by: LLM
Signed-off-by: Zhiling Zou <zhilinz at nebusec.ai>
---
 net/rxrpc/insecure.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/rxrpc/insecure.c b/net/rxrpc/insecure.c
index 0b39046bdc616..48e5db748ade2 100644
--- a/net/rxrpc/insecure.c
+++ b/net/rxrpc/insecure.c
@@ -44,7 +44,7 @@ static bool none_validate_challenge(struct rxrpc_connection *conn,
 {
 	rxrpc_abort_conn(conn, skb, RX_PROTOCOL_ERROR, -EPROTO,
 			 rxrpc_eproto_rxnull_challenge);
-	return true;
+	return false;
 }
 
 static int none_sendmsg_respond_to_challenge(struct sk_buff *challenge,
-- 
2.55.0