iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

tls: rx: don't keep decrypted skbs on ctx->recv_pkt

Browse Source 
Detach the skb from ctx->recv_pkt after decryption is done,
even if we can't consume it.

Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Jakub Kicinski
2022-07-14 22:22:27 -07:00
committed by David S. Miller
parent 008141de85
commit abb47dc95d
1 changed files with 28 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

49
net/tls/tls_sw.c
View File

@@ -1648,6 +1648,12 @@ static int tls_record_content_type(struct msghdr *msg, struct tls_msg *tlm,
return 1; return 1;
} }
static void tls_rx_rec_done(struct tls_sw_context_rx *ctx)
{
ctx->recv_pkt = NULL;
__strp_unpause(&ctx->strp);
}
/* This function traverses the rx_list in tls receive context to copies the /* This function traverses the rx_list in tls receive context to copies the
* decrypted records into the buffer provided by caller zero copy is not * decrypted records into the buffer provided by caller zero copy is not
* true. Further, the records are removed from the rx_list if it is not a peek * true. Further, the records are removed from the rx_list if it is not a peek
@@ -1902,15 +1908,20 @@ int tls_sw_recvmsg(struct sock *sk,
* For tls1.3, we disable async. * For tls1.3, we disable async.
*/ */
err = tls_record_content_type(msg, tlm, &control); err = tls_record_content_type(msg, tlm, &control);
if (err <= 0) if (err <= 0) {
tls_rx_rec_done(ctx);
put_on_rx_list_err:
__skb_queue_tail(&ctx->rx_list, skb);
goto recv_end; goto recv_end;
}
/* periodically flush backlog, and feed strparser */ /* periodically flush backlog, and feed strparser */
tls_read_flush_backlog(sk, prot, len, to_decrypt, tls_read_flush_backlog(sk, prot, len, to_decrypt,
decrypted + copied, &flushed_at); decrypted + copied, &flushed_at);
ctx->recv_pkt = NULL; /* TLS 1.3 may have updated the length by more than overhead */
__strp_unpause(&ctx->strp); chunk = rxm->full_len;
tls_rx_rec_done(ctx);
if (async) { if (async) {
/* TLS 1.2-only, to_decrypt must be text length */ /* TLS 1.2-only, to_decrypt must be text length */
@@ -1921,8 +1932,6 @@ put_on_rx_list:
__skb_queue_tail(&ctx->rx_list, skb); __skb_queue_tail(&ctx->rx_list, skb);
continue; continue;
} }
/* TLS 1.3 may have updated the length by more than overhead */
chunk = rxm->full_len;
if (!darg.zc) { if (!darg.zc) {
bool partially_consumed = chunk > len; bool partially_consumed = chunk > len;
@@ -1943,10 +1952,8 @@ put_on_rx_list:
err = skb_copy_datagram_msg(skb, rxm->offset, err = skb_copy_datagram_msg(skb, rxm->offset,
msg, chunk); msg, chunk);
if (err < 0) { if (err < 0)
__skb_queue_tail(&ctx->rx_list, skb); goto put_on_rx_list_err;
goto recv_end;
}
if (is_peek) if (is_peek)
goto put_on_rx_list; goto put_on_rx_list;
@@ -2020,7 +2027,6 @@ ssize_t tls_sw_splice_read(struct socket *sock, loff_t *ppos,
struct tls_msg *tlm; struct tls_msg *tlm;
struct sk_buff *skb; struct sk_buff *skb;
ssize_t copied = 0; ssize_t copied = 0;
bool from_queue;
int err = 0; int err = 0;
long timeo; long timeo;
int chunk; int chunk;
@@ -2029,8 +2035,7 @@ ssize_t tls_sw_splice_read(struct socket *sock, loff_t *ppos,
if (timeo < 0) if (timeo < 0)
return timeo; return timeo;
from_queue = !skb_queue_empty(&ctx->rx_list); if (!skb_queue_empty(&ctx->rx_list)) {
if (from_queue) {
skb = __skb_dequeue(&ctx->rx_list); skb = __skb_dequeue(&ctx->rx_list);
} else { } else {
struct tls_decrypt_arg darg = {}; struct tls_decrypt_arg darg = {};
@@ -2047,6 +2052,8 @@ ssize_t tls_sw_splice_read(struct socket *sock, loff_t *ppos,
tls_err_abort(sk, -EBADMSG); tls_err_abort(sk, -EBADMSG);
goto splice_read_end; goto splice_read_end;
} }
tls_rx_rec_done(ctx);
} }
rxm = strp_msg(skb); rxm = strp_msg(skb);
@@ -2055,29 +2062,29 @@ ssize_t tls_sw_splice_read(struct socket *sock, loff_t *ppos,
/* splice does not support reading control messages */ /* splice does not support reading control messages */
if (tlm->control != TLS_RECORD_TYPE_DATA) { if (tlm->control != TLS_RECORD_TYPE_DATA) {
err = -EINVAL; err = -EINVAL;
goto splice_read_end; goto splice_requeue;
} }
chunk = min_t(unsigned int, rxm->full_len, len); chunk = min_t(unsigned int, rxm->full_len, len);
copied = skb_splice_bits(skb, sk, rxm->offset, pipe, chunk, flags); copied = skb_splice_bits(skb, sk, rxm->offset, pipe, chunk, flags);
if (copied < 0) if (copied < 0)
goto splice_read_end; goto splice_requeue;
if (!from_queue) {
ctx->recv_pkt = NULL;
__strp_unpause(&ctx->strp);
}
if (chunk < rxm->full_len) { if (chunk < rxm->full_len) {
__skb_queue_head(&ctx->rx_list, skb);
rxm->offset += len; rxm->offset += len;
rxm->full_len -= len; rxm->full_len -= len;
} else { goto splice_requeue;
consume_skb(skb);
} }
consume_skb(skb);
splice_read_end: splice_read_end:
tls_rx_reader_unlock(sk, ctx); tls_rx_reader_unlock(sk, ctx);
return copied ? : err; return copied ? : err;
splice_requeue:
__skb_queue_head(&ctx->rx_list, skb);
goto splice_read_end;
} }
bool tls_sw_sock_is_readable(struct sock *sk) bool tls_sw_sock_is_readable(struct sock *sk)