Re: [PATCH net v2 4/4] net: tls: remove bad rollback and UAF on ENOSPC

[Sabrina Dubroca <sd@queasysnail.net>]

2026-05-14, 13:18:12 +0200, Paolo Abeni wrote:
> On 5/11/26 7:49 PM, Jakub Kicinski wrote:
> > As explained in commit 54a3ecaeeeae ("bpf: fix ktls panic with sockmap")
> > once we call BPF there's no way for us to rollback the iter
> > and copy data, since BPF may have modified the message.
> > This is regardless of whether BPF set up cork or not.
> > 
> > Remove the attempt to roll back iter completely. This removes a UAF
> > since BPF may have modified msg_pl and rec, so these pointers were
> > stale.
> > 
> > Note that I'm entirely unsure what the expected behavior is here
> > for BPF. Feels like this path must not be exercised by normal
> > applications / existing deployments in the first place.
> > 
> > Fixes: d3b18ad31f93 ("tls: add bpf support to sk_msg handling")
> > Signed-off-by: Jakub Kicinski <kuba@kernel.org>
> > ---
> >  net/tls/tls_sw.c | 12 ++----------
> >  1 file changed, 2 insertions(+), 10 deletions(-)
> > 
> > diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
> > index 360f71fd7884..22b77840e35a 100644
> > --- a/net/tls/tls_sw.c
> > +++ b/net/tls/tls_sw.c
> > @@ -1164,11 +1164,8 @@ static int tls_sw_sendmsg_locked(struct sock *sk, struct msghdr *msg,
> >  				else if (ret == -ENOMEM)
> >  					goto wait_for_memory;
> >  				else if (ctx->open_rec && ret == -ENOSPC) {
> > -					if (msg_pl->cork_bytes) {
> > -						ret = 0;
> > -						goto send_end;
> > -					}
> > -					goto rollback_iter;
> > +					ret = 0;
> > +					goto send_end;
> 
> The sashiko report here looks like a pre-existing issue that could be
> handled separately.
> 
> Still let me play safe and merge just the 2 first patch in the series.

Kind of. We had agreed that #2 could be fixed in a somewhat better
way.

@Jakub removal of the content_type chaining can be done in net-next as
a clean up now I guess

-- 
Sabrina