From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-yx1-f43.google.com (mail-yx1-f43.google.com [74.125.224.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8ABA737DE92 for ; Thu, 21 May 2026 02:59:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.224.43 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779332372; cv=none; b=EkHozJ/v0dzBqQpk+bddoUawt7ar9vaK8uB9vt46UWUCrCUDL/Cg7yw1AC8KblyWPqk3HRRSdp3p/vyme7pssgoA4TA7qsqR6Vmw3+DaaWKud7ia1fIZC/PjcITTBBc/HeX9QjeE1Zx+6CnymqZr9YGDMihgh0JDRvvGgyGsgeY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779332372; c=relaxed/simple; bh=oHsfccn7DDbOn6VBM/zSWqYwTq+d7qUjU4CoIduHDQw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ZBPpO+pq+Dn50FF57BOMfivDg/0p+sNldb/fWLz3XkC3NxQ+TS+j1g1gshx0ZsOFqocLqWRze+mTZzNZ50lPqm/sGfl+qsvVs+d9RPt6v/5y9nQeaw1zZIdm0tBioLamjba+Rdx6hTCPWRG/miLn5MqlLgO0ncqjZvlgS1lwZoM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=northecho.dev; spf=none smtp.mailfrom=northecho.dev; dkim=pass (2048-bit key) header.d=northecho-dev.20251104.gappssmtp.com header.i=@northecho-dev.20251104.gappssmtp.com header.b=I/ycwK4T; arc=none smtp.client-ip=74.125.224.43 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=northecho.dev Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=northecho.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=northecho-dev.20251104.gappssmtp.com header.i=@northecho-dev.20251104.gappssmtp.com header.b="I/ycwK4T" Received: by mail-yx1-f43.google.com with SMTP id 956f58d0204a3-651c7118b74so322116d50.0 for ; Wed, 20 May 2026 19:59:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=northecho-dev.20251104.gappssmtp.com; s=20251104; t=1779332370; x=1779937170; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=+XKb2Lqr4W3lw4U2X+TN89zQnTM+iU4ox03eiLP8Puw=; b=I/ycwK4TMG9SWoBWs7GGWmpyy/zMgqVJjV8Od4XM4lPIgfZjaXoP77LJx6QdLBYdWt jspYHPHHiWy175XjS0m0NYSroj62j1DADFlesGkVd87rJ8+iffHe7cJ4MCPE0dfNWitH EMtrDVqOXk3YS90Pc2S0isRAXcb8tXf8wE8bPRqQcmqqKTE5BkQFBAYsmYBjlRUPMeuJ BmnT1Z1BA2vYfJuBjG4HJNfaxJXfN7JoBYXN/3hxTaF6U3cEEzJZgSgYri2tydgCF0bR +lMbiSVinixoE6mCPLf0n2QtakJQ79NWeMWlFbs62ZWDCptG1gvHAz25ZLk/lcZvRCnK KGbA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779332370; x=1779937170; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=+XKb2Lqr4W3lw4U2X+TN89zQnTM+iU4ox03eiLP8Puw=; b=RU5VQqVdaB9lWbs61VinG4WDFj5wT5puMhGBsM1AX1g4m63+Oho+zufq2wAGmuKs2a gInO7zK18B0IVxQHemYZpxFRzN11UahsoXCmvfEyEPeTgoQJuZC9Inkzvgs+X19QSVZf CVgtI5XIac/PdchaI7aXmUf7GHSQwu+oUvJXAZLWcz6zWoU22bs1TtTOLQMUEF/i8Iqp 21mqwmFxbQeFecfL2MXEkTP08SGfZgZZQnj2WgLdt+PlA12+ap0lurh2KxtKKg4cytH6 hmH8Sy4i1oggPCjHFUqJyjeXlvxYjXRN9KqaXOrJMNWABILzqVFbNlO2FvOgkmR4Wkrv n9XQ== X-Forwarded-Encrypted: i=1; AFNElJ9UkhzVF1BLFOIht6KnjwmmmfSLUADbR7VX8wqf73tl0yylVhYAeOyADRy+zuqaB1s7Xd5FiQ17irYdwunjdLA=@vger.kernel.org X-Gm-Message-State: AOJu0YxGS5qxNP+mD4yrfJwkUagQRf/N55A0NNzC660CgKP4xJgiq5gZ fcfEPPhGkUwXv2rLYbre00qlhk5Wo37sRLyrTp24BKXuCxutWvup9lry/SxhnAsIaG6x X-Gm-Gg: Acq92OEKxxLKUfDgnCMZHhV1n8hHbucmBhyfaqSe5qGOo6X2E+NVSfgk+heL3jnXHyo 05MdaT2jhiZK6CQWoRZ9IuNw8CrKtV9iVQt12fM/L9bFgOVD74bncBDGkbEjQzB8LD+RBVJRaRi FVzwa0jd20A9pFAZdKGcDqMM7q1d0MmOqDftRHW2gGudBk4NQGPmpsjUnGKcCnE1PVbZI2QyinR vGxaIfqjdJFJX87nVW3jVUBUzrOmMAPeqlugkNp8xXOEG93MTLchMwlJbaefqygNA+5UO68Gz2K 94LCsbey4hI8dw+mrQKHNx0D5Nh2iq6MkGA4B9XQ+xUajZirwtIX5pyjsaEE5cEE+EDtZTVvkbZ vUzFzH4qKw2OLYjXNeSnLP8wqdWdxMiIl/siIP16LFzKk5N3GpJMbY6zo2dSI0R8NGKKNC2M50S luRdWEcjPtn+kpB+BX8Ha9ywCma+VEbP2+5H/IkEW24+Ym4QAqnsaJQCT5aYb65yLF5WpzYEnId waHaZn57etOmI3X0DdUF7H2nw== X-Received: by 2002:a05:690e:140d:b0:65c:6ffb:303a with SMTP id 956f58d0204a3-65eae2fdc85mr521328d50.8.1779332369665; Wed, 20 May 2026 19:59:29 -0700 (PDT) Received: from kelso.tail8e61da.ts.net (99-10-92-174.lightspeed.rlghnc.sbcglobal.net. [99.10.92.174]) by smtp.gmail.com with ESMTPSA id 956f58d0204a3-65e0d86c850sm10092743d50.1.2026.05.20.19.59.28 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 20 May 2026 19:59:29 -0700 (PDT) From: Christopher Lusk To: Jakub Kicinski Cc: John Fastabend , Sabrina Dubroca , "David S. Miller" , Eric Dumazet , Paolo Abeni , Simon Horman , Shuah Khan , Alexei Starovoitov , Daniel Borkmann , netdev@vger.kernel.org, bpf@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH net v2 1/2] net: tls: preserve split open record on async encrypt Date: Wed, 20 May 2026 22:58:39 -0400 Message-ID: <20260521025840.976378-2-clusk@northecho.dev> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260521025840.976378-1-clusk@northecho.dev> References: <20260521025840.976378-1-clusk@northecho.dev> Precedence: bulk X-Mailing-List: linux-kselftest@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit When the BPF sk_msg verdict sets apply_bytes smaller than the current open record, tls_push_record() splits ctx->open_rec into the record being encrypted and a remainder record. The synchronous path reattaches the remainder to ctx->open_rec before continuing. If the selected AEAD provider completes asynchronously, tls_do_encryption() returns -EINPROGRESS after unhooking ctx->open_rec. tls_push_record() currently returns immediately in that case, before the split remainder is reattached. The remainder is no longer reachable through ctx->open_rec or ctx->tx_list, which can silently drop transmitted data and leak the unreachable tls_rec. Keep the split remainder rooted even when encryption of the first record is pending asynchronously, and continue the BPF verdict drain loop after an async record has been queued. If that loop then hits a later verdict error, wait for the pending async encryption before returning the error so zerocopy user pages cannot be released while cryptd still reads them. Fixes: d3b18ad31f93 ("tls: add bpf support to sk_msg handling") Cc: stable@vger.kernel.org # 4.20+ Signed-off-by: Christopher Lusk Assisted-by: Codex:gpt-5.5 Assisted-by: Claude:claude-opus-4-7 --- net/tls/tls_sw.c | 40 ++++++++++++++++++++++++++++++++-------- 1 file changed, 32 insertions(+), 8 deletions(-) diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c index 964ebc268..5b20be5b4 100644 --- a/net/tls/tls_sw.c +++ b/net/tls/tls_sw.c @@ -840,16 +840,19 @@ static int tls_push_record(struct sock *sk, int flags, rc = tls_do_encryption(sk, tls_ctx, ctx, req, msg_pl->sg.size + prot->tail_size, i); if (rc < 0) { - if (rc != -EINPROGRESS) { - tls_err_abort(sk, -EBADMSG); - if (split) { - tls_ctx->pending_open_record_frags = true; - tls_merge_open_record(sk, rec, tmp, orig_end); - } + if (rc == -EINPROGRESS) + goto split_done; + + tls_err_abort(sk, -EBADMSG); + if (split) { + tls_ctx->pending_open_record_frags = true; + tls_merge_open_record(sk, rec, tmp, orig_end); } ctx->async_capable = 1; return rc; - } else if (split) { + } +split_done: + if (split) { msg_pl = &tmp->msg_plaintext; msg_en = &tmp->msg_encrypted; sk_msg_trim(sk, msg_en, msg_pl->sg.size + prot->overhead_size); @@ -857,6 +860,11 @@ static int tls_push_record(struct sock *sk, int flags, ctx->open_rec = tmp; } + if (rc < 0) { + ctx->async_capable = 1; + return rc; + } + return tls_tx_records(sk, flags); } @@ -871,6 +879,8 @@ static int bpf_exec_tx_verdict(struct sk_msg *msg, struct sock *sk, struct sock *sk_redir; struct tls_rec *rec; bool enospc, policy, redir_ingress; + bool async = false; + int async_err = 0; int err = 0, send; u32 delta = 0; @@ -920,6 +930,10 @@ static int bpf_exec_tx_verdict(struct sk_msg *msg, struct sock *sk, switch (psock->eval) { case __SK_PASS: err = tls_push_record(sk, flags, record_type); + if (err == -EINPROGRESS) { + async = true; + err = 0; + } if (err && err != -EINPROGRESS && sk->sk_err == EBADMSG) { *copied -= sk_msg_free(sk, msg); tls_free_open_rec(sk); @@ -988,8 +1002,18 @@ static int bpf_exec_tx_verdict(struct sk_msg *msg, struct sock *sk, goto more_data; } out_err: + if (async && err && err != -EINPROGRESS) { + async_err = tls_encrypt_async_wait(ctx); + if (test_and_clear_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask)) { + /* tx_lock is held; the worker will reschedule if needed. */ + cancel_delayed_work(&ctx->tx_work.work); + tls_tx_records(sk, flags); + } + if (async_err) + err = async_err; + } sk_psock_put(sk, psock); - return err; + return err ?: (async ? -EINPROGRESS : 0); } static int tls_sw_push_pending_record(struct sock *sk, int flags) -- 2.54.0