Skip to content

Commit 55b2984

Browse files
dhowellskuba-moo
authored andcommitted
rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets
Fix rxrpc_input_call_event() to only unshare DATA packets and not ACK, ABORT, etc.. And with that, rxrpc_input_packet() doesn't need to take a pointer to the pointer to the packet, so change that to just a pointer. Fixes: 1f27401 ("rxrpc: Fix potential UAF after skb_unshare() failure") Closes: https://sashiko.dev/#/patchset/20260422161438.2593376-4-dhowells@redhat.com Signed-off-by: David Howells <dhowells@redhat.com> cc: Marc Dionne <marc.dionne@auristor.com> cc: Jeffrey Altman <jaltman@auristor.com> cc: Simon Horman <horms@kernel.org> cc: linux-afs@lists.infradead.org cc: stable@kernel.org Link: https://patch.msgid.link/20260423200909.3049438-2-dhowells@redhat.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
1 parent 27ae4bc commit 55b2984

1 file changed

Lines changed: 2 additions & 1 deletion

File tree

net/rxrpc/call_event.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -332,7 +332,8 @@ bool rxrpc_input_call_event(struct rxrpc_call *call)
332332

333333
saw_ack |= sp->hdr.type == RXRPC_PACKET_TYPE_ACK;
334334

335-
if (sp->hdr.securityIndex != 0 &&
335+
if (sp->hdr.type == RXRPC_PACKET_TYPE_DATA &&
336+
sp->hdr.securityIndex != 0 &&
336337
skb_cloned(skb)) {
337338
/* Unshare the packet so that it can be
338339
* modified by in-place decryption.

0 commit comments

Comments
 (0)