linux-next: manual merge of the nfsd tree with the nfs-anna tree

[Mark Brown <broonie@kernel.org>]

[-- Attachment #1: Type: text/plain, Size: 2422 bytes --]

Hi all,

Today's linux-next merge of the nfsd tree got a conflict in:

  net/sunrpc/xprtsock.c

between commits:

  ced837addad37 ("SUNRPC: fold xs_sock_process_cmsg() into its only caller")
  2e3f0f157f227 ("SUNRPC: treat every client-side TLS error alert as fatal")
  adc5399386f7b ("SUNRPC: reject a client-side TLS alert record that is not two octets")

from the nfs-anna tree and commits:

  21bcc6ccc6cd0 ("SUNRPC: Fold xs_sock_process_cmsg() into its only caller")
  6b91817001fb1 ("SUNRPC: Treat every client-side TLS error alert as fatal")
  91bdf2ae4a279 ("SUNRPC: Reject a client-side TLS alert record that is not two octets")

from the nfsd tree.

I fixed it up (see below) and can carry the fix as necessary. This
is now fixed as far as linux-next is concerned, but any non trivial
conflicts should be mentioned to your upstream maintainer when your tree
is submitted for merging.  You may also want to consider cooperating
with the maintainer of the conflicting tree to minimise any particularly
complex conflicts.

(The comments were different, I took nfs-anna's version)

diff --combined net/sunrpc/xprtsock.c
index f5a5136327ba8,ca22ca8f2fea7..0000000000000
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@@ -386,20 -386,17 +386,20 @@@ xs_sock_recv_cmsg(struct socket *sock, 
  		if (tls_get_record_type(sock->sk, &u.cmsg) !=
  		    TLS_RECORD_TYPE_ALERT)
  			return -EAGAIN;
 -		/* An Alert record carries exactly one two-octet message
 -		 * (RFC 8446 Section 5.1). alert_kvec caps the receive at
 -		 * two, so the count alone cannot reliably detect an
 -		 * oversized record.
 +		/* RFC 8446 Section 5.1: a record with an Alert type carries
 +		 * exactly one message, and an alert is two octets.
 +		 * tls_alert_recv() reads both without checking the length.
 +		 * alert_kvec caps the count at two, so a longer record
 +		 * fills it as well. kTLS sets MSG_EOR only once the
 +		 * record has been drained.
  		 */
  		if (ret != sizeof(alert) || !(msg.msg_flags & MSG_EOR))
  			return -EACCES;
  		iov_iter_revert(&msg.msg_iter, ret);
  		tls_alert_recv(sock->sk, &msg, &level, &description);
  		/* RFC 8446 Section 6: every alert but a closure alert is
 -		 * an error alert.
 +		 * an error alert, whatever the legacy AlertLevel octet
 +		 * says.
  		 */
  		switch (description) {
  		case TLS_ALERT_DESC_CLOSE_NOTIFY:

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]