Wind River Support Network

Description

In the Linux kernel, the following vulnerability has been resolved:EOL][EOL]rxrpc: Fix bug due to prealloc collision[EOL][EOL]When userspace is using AF_RXRPC to provide a server, it has to preallocate[EOL]incoming calls and assign to them call IDs that will be used to thread[EOL]related recvmsg() and sendmsg() together.  The preallocated call IDs will[EOL]automatically be attached to calls as they come in until the pool is empty.[EOL][EOL]To the kernel, the call IDs are just arbitrary numbers, but userspace can[EOL]use the call ID to hold a pointer to prepared structs.  In any case, the[EOL]user isn't permitted to create two calls with the same call ID (call IDs[EOL]become available again when the call ends) and EBADSLT should result from[EOL]sendmsg() if an attempt is made to preallocate a call with an in-use call[EOL]ID.[EOL][EOL]However, the cleanup in the error handling will trigger both assertions in[EOL]rxrpc_cleanup_call() because the call isn't marked complete and isn't[EOL]marked as having been released.[EOL][EOL]Fix this by setting the call state in rxrpc_service_prealloc_one() and then[EOL]marking it as being released before calling the cleanup function.

CREATE(Triage):(User=pbi-cn) [CVE-2025-38544 (https://nvd.nist.gov/vuln/detail/CVE-2025-38544)