* [PATCH 1/2] nvme-tcp: move the TLS record read loop into a helper
2026-11-09 19:04 [PATCH 0/2] nvme-tcp: consume TLS records without application data on a live queue Martin Belanger via B4 Relay
@ 2026-11-09 19:04 ` Martin Belanger via B4 Relay
[not found] ` <sashiko-outbox-205465@kernel.org>
2026-11-09 19:04 ` [PATCH 2/2] nvme-tcp: consume TLS records without application data Martin Belanger via B4 Relay
1 sibling, 1 reply; 5+ messages in thread
From: Martin Belanger via B4 Relay @ 2026-11-09 19:04 UTC (permalink / raw)
To: Keith Busch, Jens Axboe, Christoph Hellwig, Sagi Grimberg,
Hannes Reinecke
Cc: Martin Belanger, linux-nvme, linux-kernel, Martin Belanger, stable
From: Martin Belanger <martin.belanger@dell.com>
Move the read loop out of nvme_tcp_skip_tls_record() into a new
helper, nvme_tcp_drain_tls_record(). The next patch uses the helper
to read TLS records that arrive on a live queue.
No functional change.
Cc: stable@vger.kernel.org
Signed-off-by: Martin Belanger <martin.belanger@dell.com>
---
drivers/nvme/host/tcp.c | 60 +++++++++++++++++++++++++++++++------------------
1 file changed, 38 insertions(+), 22 deletions(-)
diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
index 7ecc6c007f8d..bf71e6f6a6ef 100644
--- a/drivers/nvme/host/tcp.c
+++ b/drivers/nvme/host/tcp.c
@@ -1623,31 +1623,16 @@ static int nvme_tcp_recv_tls_alert(struct nvme_tcp_queue *queue,
}
/*
- * Discard a TLS record that arrived in place of the ICResp. A peer may send
- * a NewSessionTicket as soon as the handshake completes.
+ * Read the rest of a TLS record whose first part was read into @msg.
*
- * Returns 0 when the record was discarded and the ICResp can be read, or a
- * negative errno if the connection cannot continue.
+ * Returns the bytes read, or a negative errno.
*/
-static int nvme_tcp_skip_tls_record(struct nvme_tcp_queue *queue,
- struct msghdr *msg, u8 ctype, int len)
+static int nvme_tcp_drain_tls_record(struct nvme_tcp_queue *queue,
+ struct msghdr *msg, int flags)
{
u8 buf[NVME_TCP_TLS_REC_CHUNK];
- int ret;
+ int ret, drained = 0;
- switch (ctype) {
- case TLS_RECORD_TYPE_HANDSHAKE:
- break;
- case TLS_RECORD_TYPE_ALERT:
- ret = nvme_tcp_recv_tls_alert(queue, msg, len);
- return ret ? : -ENOTCONN;
- default:
- pr_err("queue %d: unhandled TLS record %u\n",
- nvme_tcp_queue_id(queue), ctype);
- return -ENOTCONN;
- }
-
- /* the ICResp is in a later record, drain this one first */
while (!(msg->msg_flags & MSG_EOR)) {
struct kvec iov = {
.iov_base = buf,
@@ -1661,16 +1646,47 @@ static int nvme_tcp_skip_tls_record(struct nvme_tcp_queue *queue,
};
ret = kernel_recvmsg(queue->sock, &drain, &iov, 1, sizeof(buf),
- 0);
+ flags);
if (ret <= 0) {
pr_warn("queue %d: failed to drain TLS record: %d\n",
nvme_tcp_queue_id(queue), ret);
return ret ? : -ECONNRESET;
}
+ drained += ret;
msg->msg_flags = drain.msg_flags;
}
- return 0;
+ return drained;
+}
+
+/*
+ * Discard a TLS record that arrived in place of the ICResp. A peer may send
+ * a NewSessionTicket as soon as the handshake completes.
+ *
+ * Returns 0 when the record was discarded and the ICResp can be read, or a
+ * negative errno if the connection cannot continue.
+ */
+static int nvme_tcp_skip_tls_record(struct nvme_tcp_queue *queue,
+ struct msghdr *msg, u8 ctype, int len)
+{
+ int ret;
+
+ switch (ctype) {
+ case TLS_RECORD_TYPE_HANDSHAKE:
+ break;
+ case TLS_RECORD_TYPE_ALERT:
+ ret = nvme_tcp_recv_tls_alert(queue, msg, len);
+ return ret ? : -ENOTCONN;
+ default:
+ pr_err("queue %d: unhandled TLS record %u\n",
+ nvme_tcp_queue_id(queue), ctype);
+ return -ENOTCONN;
+ }
+
+ /* the ICResp is in a later record, drain this one first */
+ ret = nvme_tcp_drain_tls_record(queue, msg, 0);
+
+ return ret < 0 ? ret : 0;
}
/*
--
2.53.0
^ permalink raw reply [flat|nested] 5+ messages in thread* [PATCH 2/2] nvme-tcp: consume TLS records without application data
2026-11-09 19:04 [PATCH 0/2] nvme-tcp: consume TLS records without application data on a live queue Martin Belanger via B4 Relay
2026-11-09 19:04 ` [PATCH 1/2] nvme-tcp: move the TLS record read loop into a helper Martin Belanger via B4 Relay
@ 2026-11-09 19:04 ` Martin Belanger via B4 Relay
[not found] ` <sashiko-outbox-205483@kernel.org>
1 sibling, 1 reply; 5+ messages in thread
From: Martin Belanger via B4 Relay @ 2026-11-09 19:04 UTC (permalink / raw)
To: Keith Busch, Jens Axboe, Christoph Hellwig, Sagi Grimberg,
Hannes Reinecke
Cc: Martin Belanger, linux-nvme, linux-kernel, Martin Belanger, stable
From: Martin Belanger <martin.belanger@dell.com>
A peer may send a TLS record without application data at any time
after the handshake: a NewSessionTicket, a KeyUpdate or an alert.
tls_sw_read_sock() cannot pass such a record to nvme_tcp_recv_skb().
It returns -EINVAL and leaves the record at the head of the receive
queue. nvme_tcp_try_recv() then starts error recovery, and the
controller reconnects.
TLS 1.3 allows a server to send a NewSessionTicket at any time after
the handshake (RFC 8446, section 4.6.1). Alerts can also arrive at any
time.
On -EINVAL, read the record with recvmsg(), which reports the record
type. Discard handshake messages other than KeyUpdate. Log alerts, and
fail the queue on a fatal alert. Fail the queue on a KeyUpdate, which
nvme-tcp cannot answer, and on any other record type. recvmsg() takes
the socket lock, so release it around the read.
svc_tcp_recvfrom() in sunrpc handles -EINVAL from read_sock() the same
way.
Fixes: be8e82caa685 ("nvme-tcp: enable TLS handshake upcall")
Cc: stable@vger.kernel.org
Signed-off-by: Martin Belanger <martin.belanger@dell.com>
---
drivers/nvme/host/tcp.c | 86 +++++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 86 insertions(+)
diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
index bf71e6f6a6ef..d460273a328a 100644
--- a/drivers/nvme/host/tcp.c
+++ b/drivers/nvme/host/tcp.c
@@ -1444,6 +1444,8 @@ static int nvme_tcp_try_send(struct nvme_tcp_queue *queue)
return ret;
}
+static int nvme_tcp_recv_tls_record(struct nvme_tcp_queue *queue);
+
static int nvme_tcp_try_recv(struct nvme_tcp_queue *queue)
{
struct socket *sock = queue->sock;
@@ -1456,6 +1458,18 @@ static int nvme_tcp_try_recv(struct nvme_tcp_queue *queue)
lock_sock(sk);
queue->nr_cqe = 0;
consumed = sock->ops->read_sock(sk, &rd_desc, nvme_tcp_recv_skb);
+ /*
+ * kTLS cannot pass a TLS record without application data to
+ * nvme_tcp_recv_skb(). It returns -EINVAL and leaves the record at
+ * the head of the receive queue. recvmsg() takes the socket lock,
+ * so read the record without it.
+ */
+ if (unlikely(consumed == -EINVAL && nvme_tcp_queue_tls(queue) &&
+ queue->rd_enabled)) {
+ release_sock(sk);
+ consumed = nvme_tcp_recv_tls_record(queue);
+ lock_sock(sk);
+ }
/*
* nvme_tcp_recv_skb() handles its own errors, so a queue that is
* still enabled failed inside read_sock(). Handle it before
@@ -1659,6 +1673,78 @@ static int nvme_tcp_drain_tls_record(struct nvme_tcp_queue *queue,
return drained;
}
+/*
+ * Read the TLS record that read_sock() could not pass to
+ * nvme_tcp_recv_skb(). The caller must not hold the socket lock.
+ *
+ * A KeyUpdate needs new keys that nothing here can supply. Other handshake
+ * messages, such as a NewSessionTicket, are discarded.
+ *
+ * Returns the bytes consumed, or a negative errno if the connection cannot
+ * continue.
+ */
+static int nvme_tcp_recv_tls_record(struct nvme_tcp_queue *queue)
+{
+ u8 buf[NVME_TCP_TLS_REC_CHUNK];
+ char cbuf[CMSG_LEN(sizeof(char))] = {};
+ struct kvec iov = {
+ .iov_base = buf,
+ .iov_len = sizeof(buf),
+ };
+ struct msghdr msg = {
+ .msg_control = cbuf,
+ .msg_controllen = sizeof(cbuf),
+ };
+ int len, ret;
+ u8 ctype;
+
+ len = kernel_recvmsg(queue->sock, &msg, &iov, 1, sizeof(buf),
+ MSG_DONTWAIT);
+ if (len <= 0) {
+ dev_err(queue->ctrl->ctrl.device,
+ "queue %d: failed to read TLS record: %d\n",
+ nvme_tcp_queue_id(queue), len);
+ goto fail;
+ }
+
+ ctype = tls_get_record_type(queue->sock->sk, (struct cmsghdr *)cbuf);
+ switch (ctype) {
+ case TLS_RECORD_TYPE_HANDSHAKE:
+ if (buf[0] == TLS_HANDSHAKE_KEYUPDATE) {
+ dev_err(queue->ctrl->ctrl.device,
+ "queue %d: peer sent a TLS KeyUpdate, which is not supported\n",
+ nvme_tcp_queue_id(queue));
+ return -EKEYEXPIRED;
+ }
+ break;
+ case TLS_RECORD_TYPE_ALERT:
+ ret = nvme_tcp_recv_tls_alert(queue, &msg, len);
+ if (ret)
+ return ret;
+ break;
+ default:
+ dev_err(queue->ctrl->ctrl.device,
+ "queue %d: unexpected TLS record %u\n",
+ nvme_tcp_queue_id(queue), ctype);
+ return -EPROTO;
+ }
+
+ ret = nvme_tcp_drain_tls_record(queue, &msg, MSG_DONTWAIT);
+ if (ret < 0) {
+ len = ret;
+ goto fail;
+ }
+
+ return len + ret;
+
+fail:
+ /* read_sock() left a whole record, so none of it can be missing */
+ if (len == -EAGAIN)
+ return -EPROTO;
+
+ return len ? : -ECONNRESET;
+}
+
/*
* Discard a TLS record that arrived in place of the ICResp. A peer may send
* a NewSessionTicket as soon as the handshake completes.
--
2.53.0
^ permalink raw reply [flat|nested] 5+ messages in thread