[PATCH] rxrpc: rxgk: round up appdata length when sizing the authenticator

[Noah Weinberger]

Hello,

rxgk_construct_response() sizes the authenticator from the
unrounded application-data length:

    auth_len = 20 + (4 + appdata->len) + 12 + (1 + 4) * 4;

but rxgk_construct_authenticator() builds and measures the
authenticator with the XDR-rounded length:

    return sizeof(a) + xdr_round_up(appdata->len) + sizeof(b);

and that rounded length is what gets encrypted (auth_len is
overwritten with the builder's return value before
rxgk_encrypt_authenticator()). For any appdata length that is not a
multiple of 4, the encryption then runs past the space reserved in
the response buffer; the krb5 layer's bounds check catches it and
fails with WARN_ON + -EFAULT (a panic on panic_on_warn systems) -
memory safety is preserved by that guard, but the response path is
broken for all non-multiple-of-4 appdata. The patch rounds the
appdata length in the original sizing, matching the builder.

Affected version/commit: mainline 8a65162514fbad21a2c58ffed65f42b27e92b163 (v7.4-rc2 window, 2026-11-08), net/rxrpc/rxgk.c:939 (auth_len = 20 + (4 + appdata->len) + 12 + (1 + 4) * 4 - unrounded), :893 (rxgk_construct_authenticator returns sizeof(a) + xdr_round_up(appdata->len) + sizeof(b) - rounded), :971-975 (encrypt uses the rounded length within the unrounded-derived buffer), crypto/krb5/rfc3961_simplified.c:560-561 and rfc8009_aes2.c:193-194 (cksum_offset + cksum_len > sg_len -> WARN_ON, -EFAULT)
New-ish RXGK code (2025-era), unfixed in the reviewed window.

This was found during an assisted (AI-supported) static source review of
mainline 8a65162514fbad21a2c58ffed65f42b27e92b163 (v7.4-rc2 window, 2026-11-08). The patch below has NOT been compiled and has
NOT been runtime tested, and no reproducer was produced - the triggering
conditions are described above instead. Please treat this as a report for
verification rather than a battle-tested fix.

---
diff --git a/net/rxrpc/rxgk.c b/net/rxrpc/rxgk.c
index 77a67ace1d..a4e767ad95 100644
--- a/net/rxrpc/rxgk.c
+++ b/net/rxrpc/rxgk.c
@@ -936,7 +936,7 @@ static int rxgk_construct_response(struct rxrpc_connection *conn,
 	if (IS_ERR(gk))
 		return PTR_ERR(gk);
 
-	auth_len = 20 + (4 + appdata->len) + 12 + (1 + 4) * 4;
+	auth_len = 20 + (4 + xdr_round_up(appdata->len)) + 12 + (1 + 4) * 4;
 	authx_len = crypto_krb5_how_much_buffer(gk->krb5, KRB5_ENCRYPT_MODE,
 						auth_len, &auth_offset);
 	len = sizeof(struct rxrpc_wire_header) +