On Wed, Aug 6, 2025 at 1:20 PM Jakub Kicinski kuba@kernel.org wrote:
On Wed, 6 Aug 2025 11:35:28 -0700 Eric Dumazet wrote:
TLS expects that it owns the receive queue of the TCP socket. This cannot be guaranteed in case the reader of the TCP socket entered before the TLS ULP was installed, or uses some non-standard read API (eg. zerocopy ones). Make sure that the TCP sequence numbers match between ->data_ready and ->recvmsg, otherwise don't trust the work that ->data_ready has done.
Signed-off-by: William Liu will@willsroot.io Signed-off-by: Savino Dicanosa savy@syst3mfailure.io
I presume you meant Reported-by tags ?
Oops..
Link: https://lore.kernel.org/tFjq_kf7sWIG3A7CrCg_egb8CVsT_gsmHAK0_wxDPJXfIzxFAMxq... Fixes: 84c61fe1a75b ("tls: rx: do not use the standard strparser") Signed-off-by: Jakub Kicinski kuba@kernel.org
include/net/tls.h | 1 + net/tls/tls.h | 2 +- net/tls/tls_strp.c | 17 ++++++++++++++--- net/tls/tls_sw.c | 3 ++- 4 files changed, 18 insertions(+), 5 deletions(-)
diff --git a/include/net/tls.h b/include/net/tls.h index 857340338b69..37344a39e4c9 100644 --- a/include/net/tls.h +++ b/include/net/tls.h @@ -117,6 +117,7 @@ struct tls_strparser { bool msg_ready;
struct strp_msg stm;
u32 copied_seq;Can a 2^32 wrap occur eventually ?
Hm, good point. Is it good enough if we also check it in data_ready? That way we should notice that someone is eating our data before the seq had a chance to wrap?
I could not understand what your suggestion was.
Perhaps store both copued_seq and tp->bytes_received and
check if (tp->bytes_received - strp->bytes_received) is smaller than 2^31 .
if (unlikely(strp->copied_seq != tp->copied_seq || (tp->bytes_received - strp->bytes_received >= (1ULL < 31)) || WARN_ON(tcp_inq(strp->sk) < strp->stm.full_len))) {