Skip to content

Commit 7e25be9

Browse files
author
CKI KWF Bot
committed
Merge: tls: stable backport for 9.8 phase 2
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/7430 JIRA: https://issues.redhat.com/browse/RHEL-115640 Backport of upstream commits: 5071a1e ("net: tls: explicitly disallow disconnect") a1328a6 ("selftests: tls: check that disconnect does nothing") 54a3eca ("bpf: fix ktls panic with sockmap") 491deb9 ("net/tls: fix kernel panic when alloc_page failed") 178f6a5 ("bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls") 6db015f ("tls: handle data disappearing from under the TLS ULP") d7e8259 ("selftests: tls: test TCP stealing data from under the TLS socket") 715c7a3 ("selftests: tls: make the new data_steal test less flaky") 0aeb54a ("tls: make sure to abort the stream if headers are bogus") 4c05c7e ("selftests: tls: test skb copy under mem pressure and OOB") Signed-off-by: Sabrina Dubroca <sdubroca@redhat.com> Approved-by: Hangbin Liu <haliu@redhat.com> Approved-by: Xin Long <lxin@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com>
2 parents dacca45 + d77dfaa commit 7e25be9

File tree

5 files changed

+161
-15
lines changed

5 files changed

+161
-15
lines changed

‎net/tls/tls.h‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -139,6 +139,7 @@ void update_sk_prot(struct sock *sk, struct tls_context *ctx);
139139

140140
int wait_on_pending_writer(struct sock *sk, long *timeo);
141141
void tls_err_abort(struct sock *sk, int err);
142+
void tls_strp_abort_strp(struct tls_strparser *strp, int err);
142143

143144
int init_prot_info(struct tls_prot_info *prot,
144145
const struct tls_crypto_info *crypto_info,
@@ -197,7 +198,7 @@ void tls_strp_msg_done(struct tls_strparser *strp);
197198
int tls_rx_msg_size(struct tls_strparser *strp, struct sk_buff *skb);
198199
void tls_rx_msg_ready(struct tls_strparser *strp);
199200

200-
void tls_strp_msg_load(struct tls_strparser *strp, bool force_refresh);
201+
bool tls_strp_msg_load(struct tls_strparser *strp, bool force_refresh);
201202
int tls_strp_msg_cow(struct tls_sw_context_rx *ctx);
202203
struct sk_buff *tls_strp_msg_detach(struct tls_sw_context_rx *ctx);
203204
int tls_strp_msg_hold(struct tls_strparser *strp, struct sk_buff_head *dst);

‎net/tls/tls_main.c‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -803,6 +803,11 @@ static int tls_setsockopt(struct sock *sk, int level, int optname,
803803
return do_tls_setsockopt(sk, optname, optval, optlen);
804804
}
805805

806+
static int tls_disconnect(struct sock *sk, int flags)
807+
{
808+
return -EOPNOTSUPP;
809+
}
810+
806811
struct tls_context *tls_ctx_create(struct sock *sk)
807812
{
808813
struct inet_connection_sock *icsk = inet_csk(sk);
@@ -901,6 +906,7 @@ static void build_protos(struct proto prot[TLS_NUM_CONFIG][TLS_NUM_CONFIG],
901906
prot[TLS_BASE][TLS_BASE] = *base;
902907
prot[TLS_BASE][TLS_BASE].setsockopt = tls_setsockopt;
903908
prot[TLS_BASE][TLS_BASE].getsockopt = tls_getsockopt;
909+
prot[TLS_BASE][TLS_BASE].disconnect = tls_disconnect;
904910
prot[TLS_BASE][TLS_BASE].close = tls_sk_proto_close;
905911

906912
prot[TLS_SW][TLS_BASE] = prot[TLS_BASE][TLS_BASE];

‎net/tls/tls_strp.c‎

Lines changed: 19 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212

1313
static struct workqueue_struct *tls_strp_wq;
1414

15-
static void tls_strp_abort_strp(struct tls_strparser *strp, int err)
15+
void tls_strp_abort_strp(struct tls_strparser *strp, int err)
1616
{
1717
if (strp->stopped)
1818
return;
@@ -210,11 +210,17 @@ static int tls_strp_copyin_frag(struct tls_strparser *strp, struct sk_buff *skb,
210210
struct sk_buff *in_skb, unsigned int offset,
211211
size_t in_len)
212212
{
213+
unsigned int nfrag = skb->len / PAGE_SIZE;
213214
size_t len, chunk;
214215
skb_frag_t *frag;
215216
int sz;
216217

217-
frag = &skb_shinfo(skb)->frags[skb->len / PAGE_SIZE];
218+
if (unlikely(nfrag >= skb_shinfo(skb)->nr_frags)) {
219+
DEBUG_NET_WARN_ON_ONCE(1);
220+
return -EMSGSIZE;
221+
}
222+
223+
frag = &skb_shinfo(skb)->frags[nfrag];
218224

219225
len = in_len;
220226
/* First make sure we got the header */
@@ -395,7 +401,6 @@ static int tls_strp_read_copy(struct tls_strparser *strp, bool qshort)
395401
return 0;
396402

397403
shinfo = skb_shinfo(strp->anchor);
398-
shinfo->frag_list = NULL;
399404

400405
/* If we don't know the length go max plus page for cipher overhead */
401406
need_spc = strp->stm.full_len ?: TLS_MAX_PAYLOAD_SIZE + PAGE_SIZE;
@@ -411,6 +416,8 @@ static int tls_strp_read_copy(struct tls_strparser *strp, bool qshort)
411416
page, 0, 0);
412417
}
413418

419+
shinfo->frag_list = NULL;
420+
414421
strp->copy_mode = 1;
415422
strp->stm.offset = 0;
416423

@@ -473,7 +480,7 @@ static void tls_strp_load_anchor_with_queue(struct tls_strparser *strp, int len)
473480
strp->stm.offset = offset;
474481
}
475482

476-
void tls_strp_msg_load(struct tls_strparser *strp, bool force_refresh)
483+
bool tls_strp_msg_load(struct tls_strparser *strp, bool force_refresh)
477484
{
478485
struct strp_msg *rxm;
479486
struct tls_msg *tlm;
@@ -482,8 +489,11 @@ void tls_strp_msg_load(struct tls_strparser *strp, bool force_refresh)
482489
DEBUG_NET_WARN_ON_ONCE(!strp->stm.full_len);
483490

484491
if (!strp->copy_mode && force_refresh) {
485-
if (WARN_ON(tcp_inq(strp->sk) < strp->stm.full_len))
486-
return;
492+
if (unlikely(tcp_inq(strp->sk) < strp->stm.full_len)) {
493+
WRITE_ONCE(strp->msg_ready, 0);
494+
memset(&strp->stm, 0, sizeof(strp->stm));
495+
return false;
496+
}
487497

488498
tls_strp_load_anchor_with_queue(strp, strp->stm.full_len);
489499
}
@@ -493,6 +503,8 @@ void tls_strp_msg_load(struct tls_strparser *strp, bool force_refresh)
493503
rxm->offset = strp->stm.offset;
494504
tlm = tls_msg(strp->anchor);
495505
tlm->control = strp->mark;
506+
507+
return true;
496508
}
497509

498510
/* Called with lock held on lower socket */
@@ -513,10 +525,8 @@ static int tls_strp_read_sock(struct tls_strparser *strp)
513525
tls_strp_load_anchor_with_queue(strp, inq);
514526
if (!strp->stm.full_len) {
515527
sz = tls_rx_msg_size(strp, strp->anchor);
516-
if (sz < 0) {
517-
tls_strp_abort_strp(strp, sz);
528+
if (sz < 0)
518529
return sz;
519-
}
520530

521531
strp->stm.full_len = sz;
522532

‎net/tls/tls_sw.c‎

Lines changed: 22 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -865,6 +865,19 @@ static int bpf_exec_tx_verdict(struct sk_msg *msg, struct sock *sk,
865865
delta = msg->sg.size;
866866
psock->eval = sk_psock_msg_verdict(sk, psock, msg);
867867
delta -= msg->sg.size;
868+
869+
if ((s32)delta > 0) {
870+
/* It indicates that we executed bpf_msg_pop_data(),
871+
* causing the plaintext data size to decrease.
872+
* Therefore the encrypted data size also needs to
873+
* correspondingly decrease. We only need to subtract
874+
* delta to calculate the new ciphertext length since
875+
* ktls does not support block encryption.
876+
*/
877+
struct sk_msg *enc = &ctx->open_rec->msg_encrypted;
878+
879+
sk_msg_trim(sk, enc, enc->sg.size - delta);
880+
}
868881
}
869882
if (msg->cork_bytes && msg->cork_bytes > msg->sg.size &&
870883
!enospc && !full_record) {
@@ -1075,9 +1088,13 @@ int tls_sw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
10751088
num_async++;
10761089
else if (ret == -ENOMEM)
10771090
goto wait_for_memory;
1078-
else if (ctx->open_rec && ret == -ENOSPC)
1091+
else if (ctx->open_rec && ret == -ENOSPC) {
1092+
if (msg_pl->cork_bytes) {
1093+
ret = 0;
1094+
goto send_end;
1095+
}
10791096
goto rollback_iter;
1080-
else if (ret != -EAGAIN)
1097+
} else if (ret != -EAGAIN)
10811098
goto send_end;
10821099
}
10831100
continue;
@@ -1382,7 +1399,8 @@ tls_rx_rec_wait(struct sock *sk, struct sk_psock *psock, bool nonblock,
13821399
return sock_intr_errno(timeo);
13831400
}
13841401

1385-
tls_strp_msg_load(&ctx->strp, released);
1402+
if (unlikely(!tls_strp_msg_load(&ctx->strp, released)))
1403+
return tls_rx_rec_wait(sk, psock, nonblock, false);
13861404

13871405
return 1;
13881406
}
@@ -2442,8 +2460,7 @@ int tls_rx_msg_size(struct tls_strparser *strp, struct sk_buff *skb)
24422460
return data_len + TLS_HEADER_SIZE;
24432461

24442462
read_failure:
2445-
tls_err_abort(strp->sk, ret);
2446-
2463+
tls_strp_abort_strp(strp, ret);
24472464
return ret;
24482465
}
24492466

‎tools/testing/selftests/net/tls.c‎

Lines changed: 112 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1630,6 +1630,41 @@ TEST_F(tls, recv_efault)
16301630
EXPECT_EQ(memcmp(rec2, recv_mem + 9, ret - 9), 0);
16311631
}
16321632

1633+
TEST_F(tls_basic, disconnect)
1634+
{
1635+
char const *test_str = "test_message";
1636+
int send_len = strlen(test_str) + 1;
1637+
struct tls_crypto_info_keys key;
1638+
struct sockaddr_in addr;
1639+
char buf[20];
1640+
int ret;
1641+
1642+
if (self->notls)
1643+
return;
1644+
1645+
tls_crypto_info_init(TLS_1_3_VERSION, TLS_CIPHER_AES_GCM_128, &key);
1646+
1647+
ret = setsockopt(self->fd, SOL_TLS, TLS_TX, &key, key.len);
1648+
ASSERT_EQ(ret, 0);
1649+
1650+
/* Pre-queue the data so that setsockopt parses it but doesn't
1651+
* dequeue it from the TCP socket. recvmsg would dequeue.
1652+
*/
1653+
EXPECT_EQ(send(self->fd, test_str, send_len, 0), send_len);
1654+
1655+
ret = setsockopt(self->cfd, SOL_TLS, TLS_RX, &key, key.len);
1656+
ASSERT_EQ(ret, 0);
1657+
1658+
addr.sin_family = AF_UNSPEC;
1659+
addr.sin_addr.s_addr = htonl(INADDR_ANY);
1660+
addr.sin_port = 0;
1661+
ret = connect(self->cfd, &addr, sizeof(addr));
1662+
EXPECT_EQ(ret, -1);
1663+
EXPECT_EQ(errno, EOPNOTSUPP);
1664+
1665+
EXPECT_EQ(recv(self->cfd, buf, send_len, 0), send_len);
1666+
}
1667+
16331668
struct raw_rec {
16341669
unsigned int plain_len;
16351670
unsigned char plain_data[100];
@@ -2223,6 +2258,22 @@ TEST_F(tls_err, poll_partial_rec_async)
22232258
}
22242259
}
22252260

2261+
/* Use OOB+large send to trigger copy mode due to memory pressure.
2262+
* OOB causes a short read.
2263+
*/
2264+
TEST_F(tls_err, oob_pressure)
2265+
{
2266+
char buf[1<<16];
2267+
int i;
2268+
2269+
memrnd(buf, sizeof(buf));
2270+
2271+
EXPECT_EQ(send(self->fd2, buf, 5, MSG_OOB), 5);
2272+
EXPECT_EQ(send(self->fd2, buf, sizeof(buf), 0), sizeof(buf));
2273+
for (i = 0; i < 64; i++)
2274+
EXPECT_EQ(send(self->fd2, buf, 5, MSG_OOB), 5);
2275+
}
2276+
22262277
TEST(non_established) {
22272278
struct tls12_crypto_info_aes_gcm_256 tls12;
22282279
struct sockaddr_in addr;
@@ -2451,6 +2502,67 @@ TEST(prequeue) {
24512502
close(cfd);
24522503
}
24532504

2505+
TEST(data_steal) {
2506+
struct tls_crypto_info_keys tls;
2507+
char buf[20000], buf2[20000];
2508+
struct sockaddr_in addr;
2509+
int sfd, cfd, ret, fd;
2510+
int pid, status;
2511+
socklen_t len;
2512+
2513+
len = sizeof(addr);
2514+
memrnd(buf, sizeof(buf));
2515+
2516+
tls_crypto_info_init(TLS_1_2_VERSION, TLS_CIPHER_AES_GCM_256, &tls);
2517+
2518+
addr.sin_family = AF_INET;
2519+
addr.sin_addr.s_addr = htonl(INADDR_ANY);
2520+
addr.sin_port = 0;
2521+
2522+
fd = socket(AF_INET, SOCK_STREAM, 0);
2523+
sfd = socket(AF_INET, SOCK_STREAM, 0);
2524+
2525+
ASSERT_EQ(bind(sfd, &addr, sizeof(addr)), 0);
2526+
ASSERT_EQ(listen(sfd, 10), 0);
2527+
ASSERT_EQ(getsockname(sfd, &addr, &len), 0);
2528+
ASSERT_EQ(connect(fd, &addr, sizeof(addr)), 0);
2529+
ASSERT_GE(cfd = accept(sfd, &addr, &len), 0);
2530+
close(sfd);
2531+
2532+
ret = setsockopt(fd, IPPROTO_TCP, TCP_ULP, "tls", sizeof("tls"));
2533+
if (ret) {
2534+
ASSERT_EQ(errno, ENOENT);
2535+
SKIP(return, "no TLS support");
2536+
}
2537+
ASSERT_EQ(setsockopt(cfd, IPPROTO_TCP, TCP_ULP, "tls", sizeof("tls")), 0);
2538+
2539+
/* Spawn a child and get it into the read wait path of the underlying
2540+
* TCP socket.
2541+
*/
2542+
pid = fork();
2543+
ASSERT_GE(pid, 0);
2544+
if (!pid) {
2545+
EXPECT_EQ(recv(cfd, buf, sizeof(buf) / 2, MSG_WAITALL),
2546+
sizeof(buf) / 2);
2547+
exit(!__test_passed(_metadata));
2548+
}
2549+
2550+
usleep(10000);
2551+
ASSERT_EQ(setsockopt(fd, SOL_TLS, TLS_TX, &tls, tls.len), 0);
2552+
ASSERT_EQ(setsockopt(cfd, SOL_TLS, TLS_RX, &tls, tls.len), 0);
2553+
2554+
EXPECT_EQ(send(fd, buf, sizeof(buf), 0), sizeof(buf));
2555+
EXPECT_EQ(wait(&status), pid);
2556+
EXPECT_EQ(status, 0);
2557+
EXPECT_EQ(recv(cfd, buf2, sizeof(buf2), MSG_DONTWAIT), -1);
2558+
/* Don't check errno, the error will be different depending
2559+
* on what random bytes TLS interpreted as the record length.
2560+
*/
2561+
2562+
close(fd);
2563+
close(cfd);
2564+
}
2565+
24542566
static void __attribute__((constructor)) fips_check(void) {
24552567
int res;
24562568
FILE *f;

0 commit comments

Comments
 (0)