Commit ac33733b10b4 for kernel

commit ac33733b10b484d666f97688561670afd5861383
Author: Anderson Nascimento <anderson@allelesecurity.com>
Date:   Wed Apr 22 17:14:35 2026 +0100

    rxrpc: Fix missing validation of ticket length in non-XDR key preparsing

    In rxrpc_preparse(), there are two paths for parsing key payloads: the
    XDR path (for large payloads) and the non-XDR path (for payloads <= 28
    bytes). While the XDR path (rxrpc_preparse_xdr_rxkad()) correctly
    validates the ticket length against AFSTOKEN_RK_TIX_MAX, the non-XDR
    path fails to do so.

    This allows an unprivileged user to provide a very large ticket length.
    When this key is later read via rxrpc_read(), the total
    token size (toksize) calculation results in a value that exceeds
    AFSTOKEN_LENGTH_MAX, triggering a WARN_ON().

    [ 2001.302904] WARNING: CPU: 2 PID: 2108 at net/rxrpc/key.c:778 rxrpc_read+0x109/0x5c0 [rxrpc]

    Fix this by adding a check in the non-XDR parsing path of rxrpc_preparse()
    to ensure the ticket length does not exceed AFSTOKEN_RK_TIX_MAX,
    bringing it into parity with the XDR parsing logic.

    Fixes: 8a7a3eb4ddbe ("KEYS: RxRPC: Use key preparsing")
    Fixes: 84924aac08a4 ("rxrpc: Fix checker warning")
    Reported-by: Anderson Nascimento <anderson@allelesecurity.com>
    Signed-off-by: Anderson Nascimento <anderson@allelesecurity.com>
    Signed-off-by: David Howells <dhowells@redhat.com>
    cc: Marc Dionne <marc.dionne@auristor.com>
    cc: Jeffrey Altman <jaltman@auristor.com>
    cc: Simon Horman <horms@kernel.org>
    cc: linux-afs@lists.infradead.org
    cc: stable@kernel.org
    Link: https://patch.msgid.link/20260422161438.2593376-7-dhowells@redhat.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/rxrpc/key.c b/net/rxrpc/key.c
index 6301d79ee35a..3ec3d89fdf14 100644
--- a/net/rxrpc/key.c
+++ b/net/rxrpc/key.c
@@ -502,6 +502,10 @@ static int rxrpc_preparse(struct key_preparsed_payload *prep)
 	if (v1->security_index != RXRPC_SECURITY_RXKAD)
 		goto error;

+	ret = -EKEYREJECTED;
+	if (v1->ticket_length > AFSTOKEN_RK_TIX_MAX)
+		goto error;
+
 	plen = sizeof(*token->kad) + v1->ticket_length;
 	prep->quotalen += plen + sizeof(*token);