From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DD142273D9F; Tue, 21 Oct 2025 19:54:45 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1761076486; cv=none; b=sfJUlZz1q99YJ4q4RuF7LW5ged+h+o66JAyPuhjelNa7x7/QcpA6EPdDGUet4jEPk1pixWRx9mUo+8QSom4UGRrCL6T5LyrTS7Ipp1gnxV9m+bp9CqESOGQrbP09xFvNStKP4WlUyl0SfV9I5tpyhcDc8AOIP2JThiyU/PM+45Q= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1761076486; c=relaxed/simple; bh=NwaRAlAnJ48DjUQZAI/uFHiNkz1D0l339FhdkrpLJHg=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=NoPQuUJ/VKEcasE4clPW/8LuRFIb/nzON1kxenv4aXRcrUxDsibBinrC/pflG3rlUTANWD7K9HXnNHLlNNjOvO/YelPjHbzSY8ZlBd0z5/KgD/acdiDCftSv6f7nCI0JB9dqAIZAAavV9jfQ+3YhsZIZYQx2H+8HQE4k3jRMF7M= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=grV64KYi; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="grV64KYi" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6AFAFC4CEF1; Tue, 21 Oct 2025 19:54:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1761076485; bh=NwaRAlAnJ48DjUQZAI/uFHiNkz1D0l339FhdkrpLJHg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=grV64KYi6oU4JbKg3HRU/gdcpHyldpcYkOYlPaJuU26sQnabJb0waKEabi9+Gz1eX 9MipAjP7zUZfr4D6hQ7eOcYh8msg8M/KX3GfaKKKVpMstG17t/kP1nL9gGXNVcn/nZ w8wco3yjtE1yxAbV82EPJhVyt7T+PKxRM2hyADzI= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Jann Horn , Sabrina Dubroca , Jakub Kicinski , Sasha Levin Subject: [PATCH 6.6 047/105] tls: always set record_type in tls_process_cmsg Date: Tue, 21 Oct 2025 21:50:56 +0200 Message-ID: <20251021195022.801819954@linuxfoundation.org> X-Mailer: git-send-email 2.51.1 In-Reply-To: <20251021195021.492915002@linuxfoundation.org> References: <20251021195021.492915002@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.6-stable review patch. If anyone has any objections, please let me know. ------------------ From: Sabrina Dubroca [ Upstream commit b6fe4c29bb51cf239ecf48eacf72b924565cb619 ] When userspace wants to send a non-DATA record (via the TLS_SET_RECORD_TYPE cmsg), we need to send any pending data from a previous MSG_MORE send() as a separate DATA record. If that DATA record is encrypted asynchronously, tls_handle_open_record will return -EINPROGRESS. This is currently treated as an error by tls_process_cmsg, and it will skip setting record_type to the correct value, but the caller (tls_sw_sendmsg_locked) handles that return value correctly and proceeds with sending the new message with an incorrect record_type (DATA instead of whatever was requested in the cmsg). Always set record_type before handling the open record. If tls_handle_open_record returns an error, record_type will be ignored. If it succeeds, whether with synchronous crypto (returning 0) or asynchronous (returning -EINPROGRESS), the caller will proceed correctly. Fixes: a42055e8d2c3 ("net/tls: Add support for async encryption of records for performance") Reported-by: Jann Horn Signed-off-by: Sabrina Dubroca Link: https://patch.msgid.link/0457252e578a10a94e40c72ba6288b3a64f31662.1760432043.git.sd@queasysnail.net Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin --- net/tls/tls_main.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c index d7dea82bcf565..c7ee44bd32064 100644 --- a/net/tls/tls_main.c +++ b/net/tls/tls_main.c @@ -254,12 +254,9 @@ int tls_process_cmsg(struct sock *sk, struct msghdr *msg, if (msg->msg_flags & MSG_MORE) return -EINVAL; - rc = tls_handle_open_record(sk, msg->msg_flags); - if (rc) - return rc; - *record_type = *(unsigned char *)CMSG_DATA(cmsg); - rc = 0; + + rc = tls_handle_open_record(sk, msg->msg_flags); break; default: return -EINVAL; -- 2.51.0