[PATCH 6.1.y 0/2] tls: fix data disappearing from under the TLS ULP (CVE-2025-38616)

[Artem Dinaburg <artem@trailofbits.com>]

Please queue these two commits for 6.1.y.

Patch 2/2 is the fix for CVE-2025-38616. It is already present in every
other supported stable tree: 6.6.y since 6.6.103, 6.12.y since 6.12.43,
and 6.18.y and 7.1.y inherit it from v6.17. 6.1.y is the only supported
affected tree still missing it. The upstream commit carries no Cc: stable
trailer, which is why 6.1.y was left behind.

Patch 1/2 is a prerequisite. In 6.1.y strp->msg_ready is still a
bitfield, so the WRITE_ONCE() added by 2/2 does not compile there:

  ./include/asm-generic/rwonce.h:55:32: error: cannot take address of
  bit-field 'msg_ready'

Backporting 0844370f8945 first converts the field to a bool, which lets
2/2 apply and build unmodified. 0844370f8945 also fixes a real bug that
6.1.y still has on its own: a lockless read of msg_ready in ->poll. It
is present in 6.6.y and later, so no newer stable tree regresses.

Both patches are verbatim upstream cherry-picks with no adaptation.
Verified on v6.1.183: both apply with no conflict, and net/tls builds
clean, including with CONFIG_DEBUG_NET=y.

CVE-2025-38616 was reproduced on a KASAN v6.1.182 build; the patched
kernel survived 1,000 rounds of the reproducer.

Jakub Kicinski (1):
  tls: handle data disappearing from under the TLS ULP

Sabrina Dubroca (1):
  tls: fix lockless read of strp->msg_ready in ->poll

 include/net/tls.h  |  3 ++-
 net/tls/tls.h      |  4 ++--
 net/tls/tls_strp.c | 17 +++++++++++------
 net/tls/tls_sw.c   |  3 ++-
 4 files changed, 17 insertions(+), 10 deletions(-)

-- 
2.43.0