The commit is pushed to "branch-rh10-6.12.0-211.16.1.12.x.vz10-ovz" and will
appear at [email protected]:openvz/vzkernel.git
after rh10-6.12.0-211.16.1.12.2.vz10
------>
commit e86e6a290c6b2c7bf711604b1399ce3e42aa0fc3
Author: David Howells <[email protected]>
Date: Thu Apr 23 21:09:06 2026 +0100
ms/rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets
Fix rxrpc_input_call_event() to only unshare DATA packets and not ACK,
ABORT, etc..
And with that, rxrpc_input_packet() doesn't need to take a pointer to the
pointer to the packet, so change that to just a pointer.
Fixes: 1f2740150f90 ("rxrpc: Fix potential UAF after skb_unshare() failure")
Closes:
https://sashiko.dev/#/patchset/[email protected]
Signed-off-by: David Howells <[email protected]>
cc: Marc Dionne <[email protected]>
cc: Jeffrey Altman <[email protected]>
cc: Simon Horman <[email protected]>
cc: [email protected]
cc: [email protected]
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Jakub Kicinski <[email protected]>
(cherry picked from commit 55b2984c96c37f909bbfe8851f13152693951382)
Follow-up fix for the backported 1f2740150f90 ("rxrpc: Fix potential UAF
after skb_unshare() failure"). Cherry-pick applied cleanly, no conflicts.
https://virtuozzo.atlassian.net/browse/VSTOR-131094
Feature: fix ms/rxrpc
Signed-off-by: Konstantin Khorenko <[email protected]>
---
net/rxrpc/call_event.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net/rxrpc/call_event.c b/net/rxrpc/call_event.c
index cc8f9dfa44e8a..fdd683261226c 100644
--- a/net/rxrpc/call_event.c
+++ b/net/rxrpc/call_event.c
@@ -332,7 +332,8 @@ bool rxrpc_input_call_event(struct rxrpc_call *call)
saw_ack |= sp->hdr.type == RXRPC_PACKET_TYPE_ACK;
- if (sp->hdr.securityIndex != 0 &&
+ if (sp->hdr.type == RXRPC_PACKET_TYPE_DATA &&
+ sp->hdr.securityIndex != 0 &&
skb_cloned(skb)) {
/* Unshare the packet so that it can be
* modified by in-place decryption.
_______________________________________________
Devel mailing list
[email protected]
https://lists.openvz.org/mailman/listinfo/devel
