rxrpc: Fix missing security check on incoming calls
authorDavid Howells <dhowells@redhat.com>
Fri, 20 Dec 2019 16:17:16 +0000 (16:17 +0000)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 17 Jan 2020 18:49:05 +0000 (19:49 +0100)
commitff8878461b9ba97eb9dbae3523fa90d11a7b5ba8
treef91930647254cd688f4f5f20382d78e9d6a0b392
parentf928970f14cb43d989d56104747dfb19abc29a71
rxrpc: Fix missing security check on incoming calls

[ Upstream commit 063c60d39180cec7c9317f5acfc3071f8fecd705 ]

Fix rxrpc_new_incoming_call() to check that we have a suitable service key
available for the combination of service ID and security class of a new
incoming call - and to reject calls for which we don't.

This causes an assertion like the following to appear:

rxrpc: Assertion failed - 6(0x6) == 12(0xc) is false
kernel BUG at net/rxrpc/call_object.c:456!

Where call->state is RXRPC_CALL_SERVER_SECURING (6) rather than
RXRPC_CALL_COMPLETE (12).

Fixes: 248f219cb8bc ("rxrpc: Rewrite the data and ack handling code")
Reported-by: Marc Dionne <marc.dionne@auristor.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
net/rxrpc/ar-internal.h
net/rxrpc/call_accept.c
net/rxrpc/conn_event.c
net/rxrpc/conn_service.c
net/rxrpc/rxkad.c
net/rxrpc/security.c