rxrpc: Fix buffer overread in rxgk_do_verify_authenticator()

Fix rxgk_do_verify_authenticator() to check the buffer size before checking
the nonce.

Fixes: 9d1d2b59341f ("rxrpc: rxgk: Implement the yfs-rxgk security class (GSSAPI)")
Closes: https://sashiko.dev/#/patchset/20260401105614.1696001-10-dhowells@redhat.com
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: Jeffrey Altman <jaltman@auristor.com>
cc: Simon Horman <horms@kernel.org>
cc: linux-afs@lists.infradead.org
cc: stable@kernel.org
Link: https://patch.msgid.link/20260408121252.2249051-20-dhowells@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/rxrpc/rxgk.c b/net/rxrpc/rxgk.c
index c67e3c2ca871a07e8e55a64312795947b2c4b883..0d5e654da918f75bd4a18b5d46619194414822be 100644 (file)
--- a/net/rxrpc/rxgk.c
+++ b/net/rxrpc/rxgk.c
@@ -1085,6 +1085,9 @@ static int rxgk_do_verify_authenticator(struct rxrpc_connection *conn,
 
        _enter("");
 
+       if ((end - p) * sizeof(__be32) < 24)
+               return rxrpc_abort_conn(conn, skb, RXGK_NOTAUTH, -EPROTO,
+                                       rxgk_abort_resp_short_auth);
        if (memcmp(p, conn->rxgk.nonce, 20) != 0)
                return rxrpc_abort_conn(conn, skb, RXGK_NOTAUTH, -EPROTO,
                                        rxgk_abort_resp_bad_nonce);
@@ -1098,7 +1101,7 @@ static int rxgk_do_verify_authenticator(struct rxrpc_connection *conn,
        p += xdr_round_up(app_len) / sizeof(__be32);
        if (end - p < 4)
                return rxrpc_abort_conn(conn, skb, RXGK_NOTAUTH, -EPROTO,
-                                       rxgk_abort_resp_short_applen);
+                                       rxgk_abort_resp_short_auth);
 
        level   = ntohl(*p++);
        epoch   = ntohl(*p++);