Commit ac33733b authored Apr 22, 2026 by Anderson Nascimento Committed by Jakub Kicinski Apr 23, 2026

rxrpc: Fix missing validation of ticket length in non-XDR key preparsing



In rxrpc_preparse(), there are two paths for parsing key payloads: the
XDR path (for large payloads) and the non-XDR path (for payloads <= 28
bytes). While the XDR path (rxrpc_preparse_xdr_rxkad()) correctly
validates the ticket length against AFSTOKEN_RK_TIX_MAX, the non-XDR
path fails to do so.

This allows an unprivileged user to provide a very large ticket length.
When this key is later read via rxrpc_read(), the total
token size (toksize) calculation results in a value that exceeds
AFSTOKEN_LENGTH_MAX, triggering a WARN_ON().

[ 2001.302904] WARNING: CPU: 2 PID: 2108 at net/rxrpc/key.c:778 rxrpc_read+0x109/0x5c0 [rxrpc]

Fix this by adding a check in the non-XDR parsing path of rxrpc_preparse()
to ensure the ticket length does not exceed AFSTOKEN_RK_TIX_MAX,
bringing it into parity with the XDR parsing logic.

Fixes: 8a7a3eb4 ("KEYS: RxRPC: Use key preparsing")
Fixes: 84924aac ("rxrpc: Fix checker warning")
Reported-by: Anderson Nascimento <anderson@allelesecurity.com>
Signed-off-by: Anderson Nascimento <anderson@allelesecurity.com>
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: Jeffrey Altman <jaltman@auristor.com>
cc: Simon Horman <horms@kernel.org>
cc: linux-afs@lists.infradead.org
cc: stable@kernel.org
Link: https://patch.msgid.link/20260422161438.2593376-7-dhowells@redhat.com


Signed-off-by: Jakub Kicinski <kuba@kernel.org>

parent 69293500

net/rxrpc/key.c

+4 −0

Original line number	Diff line number	Diff line
		@@ -502,6 +502,10 @@ static int rxrpc_preparse(struct key_preparsed_payload *prep)
		if (v1->security_index != RXRPC_SECURITY_RXKAD)
		goto error;

		ret = -EKEYREJECTED;
		if (v1->ticket_length > AFSTOKEN_RK_TIX_MAX)
		goto error;

		plen = sizeof(*token->kad) + v1->ticket_length;
		prep->quotalen += plen + sizeof(*token);