From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=209.85.216.99 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793294587; b=x4p+8Kml10xN5RbAvO4CQh35L09ha5ujt7H8yWzoUWWY0uXNM80911bsIsjI87wSZwwl 07RnGp+69ERF0nC3VBFtZDwYKzu6Mc4Rtf6GwqZLa03gxLqyjDqRkYshSws2bqyfIIMPN RFk1vfMWX9dMZxb/7navyWq898NMumh/G86+yYtLndweby/+gckjiMouHsWTKG46EvPIY WmXZuBQbb7DnrSi0XTzYYvfknq/yFTIZNrYPIrusAR43YC8LfVjOqvuQSAbuxABFiGkpC QxyO4WONHeie2aDfiF1vnlodPsD2iqoO3ENLxt0wL3VX5ge9UwzyTw0f4FOEyUO3ryQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793294587; h=DMARC-Filter:Received:DKIM-Signature:X-Google-DKIM-Signature: X-Forwarded-Encrypted:X-Gm-Message-State:X-Gm-Gg:X-Received:Received: X-Relaying-Domain:Received:Received:From:To:Cc:Subject:Date: Message-ID:X-Mailer:MIME-Version:Content-Transfer-Encoding; bh=2q8aiyZNu7WsOVILgK8CuohQb1g9BJN+Pm1TJ57mfvo=; b=04K1sOOExfEaZdXZEiS1bXt86fZeg+FIFbvZcB/wAEBXgwAkNNfqCsITzt1Od2PWmAxz JhO8JMm+Ihlmdxpdp6PJMS7/3oTI71g7//8nTkLG1tyFSjHupFfcONmjYyjVvkZSezYeb BiDnGh6fOCHdF5p15rB4sjKX1R92XMPm0u8VoRo8buzT6N1Ls+E+AKDwBp6ZjNr6KNuqZ qAzDhJEol704OUCCCzohL6BNBjKQ+b934wYKp89sND39Aw6oyxXII5wSofxQRmJ6z59oL tik7t8PmY8MxsS8Lgzu6ZwnstYj0qpyshG2t2uRBWOtPxjekd3hEHthSKBbDJahNXgA== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=purestorage.com; spf=pass smtp.mailfrom=purestorage.com; dkim=pass header.d=purestorage.com header.i=@purestorage.com header.a=rsa-sha256 header.s=google2022 header.b=KWf1cPuI; arc=none smtp.remote-ip=209.85.216.99 Received: from mail-pj1-f99.google.com (mail-pj1-f99.google.com [209.85.216.99]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B45DA606A31A for ; Thu, 29 Oct 2026 17:23:06 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org B45DA606A31A Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=purestorage.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=purestorage.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=purestorage.com header.i=@purestorage.com header.a=rsa-sha256 header.s=google2022 header.b=KWf1cPuI Received: by mail-pj1-f99.google.com with SMTP id 98e67ed59e1d1-3ad41b47541so1980012a91.1 for ; Thu, 29 Oct 2026 10:23:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=purestorage.com; s=google2022; t=1793294586; x=1793899386; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=2q8aiyZNu7WsOVILgK8CuohQb1g9BJN+Pm1TJ57mfvo=; b=KWf1cPuIggkZn92EwTkl/KvJ6hwWix4GVHBZ+DLMKXfuTvxLl70DB/JYAxMQ0/ScnM FTs5qopv8mGr2ohtYJu1dvBeEqsP+8CWgutFKJuKcj+KkfFzP1rh6GLmEUZjLJaBuTKT 2DX2hw69+zlhM46HvRseXsqq6bzUMpLmLAOhYE++1G5Qs+0ACJ6ZiYACTI1jWL/RQLMb wCXNU4GgMkXQ5J6eyO2kcwYAVA5gU7o6exSV+kcU2OzwI7NmDuWiEtEoqK94jElMUgtB SER1e+WkA3Os3koIdvKdLyqJGojOmORnPTe2L5bknuryOY2yRt03/7Lz6EwgbI0RBdgq 4Rww== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793294586; x=1793899386; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=2q8aiyZNu7WsOVILgK8CuohQb1g9BJN+Pm1TJ57mfvo=; b=oxVTuKvw0iAI/kLWjCE0FrEvueND7kFpUp0aUM9GgTCal7hfHhqz6H/IFJWMGMJI5G ZF2DAaE243b2b98A921xQ/PSv0BC10rIqVXoLYlDlnkBPUa+q28ihCZzMe1ZPU7wNYBN qi+seSuPVkUcHey/Il5w5jhg3zcqXrSJ9Y9bt2WYHA5I61KtKrvbbQ+OTRa+E1eZZgGl BV/vUPYDT3HbnAqan1QFp0gZYOtbjcQjscP/3WFMKPwPGR3rhR1IqO1hrCXhaqp6+Rq3 kN3tyhv6JrLojdfBY7UzT6l+WFJYqmOcXmP50fWake1MlCl4vwuIQTRfv4JQpVBkmXne JGqA== X-Forwarded-Encrypted: i=1; AKwUvBxPU3ZT1ge9xoyq0Qyl0IPXW8L6JwfX8Zi17bikSGZEADzIi6yyI2jBh9EIw/gevqj676ERmDR3SWslEos=@vger.kernel.org X-Gm-Message-State: AFq9FYIGKrnsFOMB5oXwygziHEa4rWWTfOF/0A8qaD4PNCCzmYO9poA3 gqgT4r1n7kPh/vBst16ijG+VhagsG7WrIE6idjKaT3AwK6OL5pDK3poKDNFQ8H2ssNn90vtiJ4V zEXH4fL79w5GBY1zw5Ba8U0TKOTfpXjOXI+jQ X-Gm-Gg: AYBFou3dpRJjeE76dDha8Hx19SFuGiwl/Z81NDUfL1SdhBEa7EQEWpEk/P/VVKhCRio gIoicbqIGQW9FGxS8RD/kw0eybw6YJ+lzDLcVY2tprRFh0h6KzQ/061RuHNcNoWf0QH0i5YWeP7 IcXjKnrH7LM525AD8nYQxF1dtMD/aqAsI4Fl/yrYIEUsvJIXKAZ+4WQclWmdTtWXQudhGoe0qNu PQlvex5tADzZ3DX2+H58dAgGJiS2RFajv68zmDsKPUGX1JBn8LsPGIaxwa7PzDdO3n0eWc0b0DD hDiF24AhtDFxS4+hsg9k/8qDAtYx1WXo0Wd0FTSyqgwpb5rSo039ulblsoFjp5U4hV7EvMtj8EV ZrO4n+2bTjC/HHmx0nPySoz8v/OS2JKft95s= X-Received: by 2002:a17:90b:3811:b0:3ad:ce34:f63c with SMTP id 98e67ed59e1d1-3ae582279a3mr5438437a91.30.1793294585949; Thu, 29 Oct 2026 10:23:05 -0700 (PDT) Received: from c7-smtp-2026.dev.purestorage.com ([208.88.159.128]) by smtp-relay.gmail.com with ESMTPS id 98e67ed59e1d1-3ae85f56a85sm24253a91.1.2026.10.29.10.23.05 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 29 Oct 2026 10:23:05 -0700 (PDT) X-Relaying-Domain: purestorage.com Received: from dev-rjethwani.dev.purestorage.com (dev-rjethwani.dev.purestorage.com [IPv6:2620:125:9025:23::2ea]) by c7-smtp-2026.dev.purestorage.com (Postfix) with ESMTP id 32BA743622; Thu, 29 Oct 2026 11:23:05 -0600 (MDT) Received: by dev-rjethwani.dev.purestorage.com (Postfix, from userid 1557719937) id 2D28ADCE139; Thu, 29 Oct 2026 11:23:05 -0600 (MDT) From: Rishikesh Jethwani To: netdev@vger.kernel.org Cc: Rishikesh Jethwani , stable@vger.kernel.org, John Fastabend , Jakub Kicinski , Sabrina Dubroca , "David S. Miller" , Eric Dumazet , Paolo Abeni , Simon Horman , Ilya Lesokhin , Boris Pismenny , Aviad Yehezkel , linux-kernel@vger.kernel.org Subject: [PATCH net v4 1/2] tls: only install push_pending_record for a TX context Date: Thu, 29 Oct 2026 11:23:00 -0600 Message-ID: <20261029172302.2944955-1-rjethwani@purestorage.com> X-Mailer: git-send-email 2.50.1 X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit tls_set_sw_offload() assigns ctx->push_pending_record for both directions, but the hook is a TX-side dispatcher. On a socket whose TX side is HW offloaded, tls_set_device_offload() installs tls_device_push_pending_record(); any later TLS_RX setsockopt overwrites it with tls_sw_push_pending_record(), because tls_set_device_offload_rx() itself calls tls_set_sw_offload(sk, 0, NULL) for the software half of a successful HW RX offload, and so does the fallback when the RX offload is declined (NIC with TX-only offload, tls_dev_add() failure). >From then on tls_handle_open_record() (a TLS_SET_RECORD_TYPE cmsg after a MSG_MORE send, or the close path with a pending writer) runs tls_sw_push_pending_record() against priv_ctx_tx, which is a struct tls_offload_context_tx, not a struct tls_sw_context_tx, and reads open_rec from inside the offload context. On x86_64 without lock debugging that field overlays sg_tx_data[2].dma_address, which is never set, so the push is silently skipped and the data buffered by the MSG_MORE send is later sent under the cmsg's record type, e.g. application data in a handshake or alert record. Enabling CONFIG_DEBUG_SPINLOCK, CONFIG_DEBUG_LOCK_ALLOC and CONFIG_LOCKDEP, but not CONFIG_LOCK_STAT, in the tested x86_64 configuration moves open_rec over sg_tx_data[5].page_link. Once populated, its page pointer and scatterlist flags are interpreted as a tls_rec pointer and dereferenced while reading msg_plaintext.sg.size. Only set the hook when initialising the TX side. Found by code review while developing TLS 1.3 HW offload rekey support. Tested with HW TLS TX and RX offload on Mellanox ConnectX-6 Dx (Crypto Enabled): after setting TLS_RX, send() "AAAA" with MSG_MORE, then sendmsg() "BBBB" with a TLS_SET_RECORD_TYPE cmsg for a handshake record. Without this patch the peer receives a single handshake record "AAAABBBB"; with it, an application data record "AAAA" followed by a handshake record "BBBB". Fixes: e8f69799810c ("net/tls: Add generic NIC offload infrastructure") Cc: stable@vger.kernel.org Signed-off-by: Rishikesh Jethwani --- net/tls/tls_sw.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c index 771e02bff519..23eb94d9da6e 100644 --- a/net/tls/tls_sw.c +++ b/net/tls/tls_sw.c @@ -2594,7 +2594,8 @@ int tls_set_sw_offload(struct sock *sk, int tx, } } - ctx->push_pending_record = tls_sw_push_pending_record; + if (tx) + ctx->push_pending_record = tls_sw_push_pending_record; /* setkey is the last operation that could fail during a * rekey. if it succeeds, we can start modifying the -- 2.50.1