On Thu, 23 Jul 2026 11:03:04 +0100 David Howells wrote:
Currently, when a CHALLENGE packet comes in, it's queued in an OOB queue on
the AF_RXRPC socket that generated one of the calls on that connection for
the application (which might be in userspace) to service. The application
then picks up the CHALLENGE and requests a RESPONSE packet be generated,
allowing the app to include app-specific data in it if appropriate. There
is, however, no actual limit on the capacity of the CHALLENGE queue, and
this could be abused remotely - and also getting the OOB mechanism right
has proven tricky.
net/rxrpc/sendmsg.c:383:37: warning: implicit conversion from 'int' to 'enum rxrpc_abort_reason' changes value from 128 to -128 [-Wconstant-conversion]
383 | trace_rxrpc_abort(call->debug_id, rxrpc_sendmsg_late_send,
| ~~~~~~~~~~~~~~~~~ ^~~~~~~~~~~~~~~~~~~~~~~
Sashiko has some comments too (Claude Sashiko didn't run since the code
didn't build cleanly).
--
pw-bot: cr