tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets

Fix rxrpc_input_call_event() to only unshare DATA packets and not ACK,
ABORT, etc..

And with that, rxrpc_input_packet() doesn't need to take a pointer to the
pointer to the packet, so change that to just a pointer.

Fixes: 1f2740150f90 ("rxrpc: Fix potential UAF after skb_unshare() failure")
Closes: https://sashiko.dev/#/patchset/20260422161438.2593376-4-dhowells@redhat.com
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: Jeffrey Altman <jaltman@auristor.com>
cc: Simon Horman <horms@kernel.org>
cc: linux-afs@lists.infradead.org
cc: stable@kernel.org
Link: https://patch.msgid.link/20260423200909.3049438-2-dhowells@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

authored by

David Howells and committed by
Jakub Kicinski 55b2984c 27ae4bcf

+2 -1
+2 -1
net/rxrpc/call_event.c
··· 332 332 333 333 saw_ack |= sp->hdr.type == RXRPC_PACKET_TYPE_ACK; 334 334 335 - if (sp->hdr.securityIndex != 0 && 335 + if (sp->hdr.type == RXRPC_PACKET_TYPE_DATA && 336 + sp->hdr.securityIndex != 0 && 336 337 skb_cloned(skb)) { 337 338 /* Unshare the packet so that it can be 338 339 * modified by in-place decryption.