From: David Howells <[email protected]>
The security operations that verify the RESPONSE packets decrypt bits of it
in place - however, the sk_buff may be shared with a packet sniffer, which
would lead to the sniffer seeing an apparently corrupt packet (actually
decrypted).
Fix this by handing a copy of the packet off to the specific security
handler if the packet was cloned.
Fixes: 17926a79320a ("[AF_RXRPC]: Provide secure RxRPC sockets for use by
userspace and kernel both")
Closes:
https://sashiko.dev/#/patchset/20260408121252.2249051-1-dhowells%40redhat.com
Signed-off-by: David Howells <[email protected]>
cc: Marc Dionne <[email protected]>
cc: Jeffrey Altman <[email protected]>
cc: Simon Horman <[email protected]>
cc: [email protected]
cc: [email protected]
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Jakub Kicinski <[email protected]>
(cherry picked from commit 24481a7f573305706054c59e275371f8d0fe919f)
Prerequisite for the CVE-2026-43500 fix aa54b1d27fe0 ("rxrpc: Also unshare
DATA/RESPONSE packets when paged frags are present"), which extends the
rxrpc_verify_response() gate added here.
Conflict: the RESPONSE case in rxrpc_process_event() conflicted because
mainline has an extra early "spin_lock_irq(&conn->state_lock); if (state !=
RXRPC_CONN_SERVICE_CHALLENGING) return 0;" block before the verify call
(from an unrelated commit not in vz10). Resolved by keeping the vz10
structure and applying only this patch's change - replacing
conn->security->verify_response(conn, skb) with rxrpc_verify_response(conn,
skb). The helper itself applied cleanly.
https://virtuozzo.atlassian.net/browse/VSTOR-131094
Feature: fix ms/rxrpc
Signed-off-by: Konstantin Khorenko <[email protected]>
---
net/rxrpc/conn_event.c | 29 ++++++++++++++++++++++++++++-
1 file changed, 28 insertions(+), 1 deletion(-)
diff --git a/net/rxrpc/conn_event.c b/net/rxrpc/conn_event.c
index 232b6986da83e..f3deed19b9fe5 100644
--- a/net/rxrpc/conn_event.c
+++ b/net/rxrpc/conn_event.c
@@ -240,6 +240,33 @@ static void rxrpc_call_is_secure(struct rxrpc_call *call)
rxrpc_notify_socket(call);
}
+static int rxrpc_verify_response(struct rxrpc_connection *conn,
+ struct sk_buff *skb)
+{
+ int ret;
+
+ if (skb_cloned(skb)) {
+ /* Copy the packet if shared so that we can do in-place
+ * decryption.
+ */
+ struct sk_buff *nskb = skb_copy(skb, GFP_NOFS);
+
+ if (nskb) {
+ rxrpc_new_skb(nskb, rxrpc_skb_new_unshared);
+ ret = conn->security->verify_response(conn, nskb);
+ rxrpc_free_skb(nskb, rxrpc_skb_put_response_copy);
+ } else {
+ /* OOM - Drop the packet. */
+ rxrpc_see_skb(skb, rxrpc_skb_see_unshare_nomem);
+ ret = -ENOMEM;
+ }
+ } else {
+ ret = conn->security->verify_response(conn, skb);
+ }
+
+ return ret;
+}
+
/*
* connection-level Rx packet processor
*/
@@ -262,7 +289,7 @@ static int rxrpc_process_event(struct rxrpc_connection
*conn,
return ret;
case RXRPC_PACKET_TYPE_RESPONSE:
- ret = conn->security->verify_response(conn, skb);
+ ret = rxrpc_verify_response(conn, skb);
if (ret < 0)
return ret;
--
2.43.0
_______________________________________________
Devel mailing list
[email protected]
https://lists.openvz.org/mailman/listinfo/devel
