From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1E3B3C433F5 for ; Wed, 18 May 2022 20:56:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242887AbiERU4y (ORCPT ); Wed, 18 May 2022 16:56:54 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40386 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242888AbiERU4v (ORCPT ); Wed, 18 May 2022 16:56:51 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 21BFC16D485 for ; Wed, 18 May 2022 13:56:51 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id CF272B821BA for ; Wed, 18 May 2022 20:56:49 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3A04DC385A9; Wed, 18 May 2022 20:56:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1652907408; bh=GZU0BeJH9huwYAv3W+vPg4bn9LnDsnsFU+EFq4CR0r4=; h=From:To:Cc:Subject:Date:From; b=sHZVvsMiPjt3RRrcGjWluX9Xizwv1VKxXqSOexecyv8uFcWN3SkO8A5rMHgVbZ265 O7prRqOg5XGvrBxFgHyrON2akA0x3GZQV5MUcIp89+sQOl8VlIIxKnp5wpbfzaZBv3 ovqrXH4BgU2W2eqbmFC1Cleip0qo21qu2VTI+8ksSRbw+4fwt9Qkc9QCZ6M/ygi63O A3D4JVaWcF40mPdmEF5Sfj9/4dJBWnnKdw5h0Dyy4pFJuNDYDZ5+7K2R7sPNcKswlH htBZ2LxSGBGCZrbAVPT6p2/uc81Dukr1IxnMbZZSoZbiJCSiGhQklSlTfLGU8meb+u +jG5aMHQsuxVw== From: Jakub Kicinski To: davem@davemloft.net Cc: netdev@vger.kernel.org, edumazet@google.com, pabeni@redhat.com, Jakub Kicinski , Artem Savkov , borisp@nvidia.com, john.fastabend@gmail.com, daniel@iogearbox.net Subject: [PATCH net-next] net: tls: fix messing up lists when bpf enabled Date: Wed, 18 May 2022 13:56:44 -0700 Message-Id: <20220518205644.2059468-1-kuba@kernel.org> X-Mailer: git-send-email 2.34.3 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Artem points out that skb may try to take over the skb and queue it to its own list. Unlink the skb before calling out. Fixes: b1a2c1786330 ("tls: rx: clear ctx->recv_pkt earlier") Reported-by: Artem Savkov Signed-off-by: Jakub Kicinski --- CC: borisp@nvidia.com CC: john.fastabend@gmail.com CC: daniel@iogearbox.net --- net/tls/tls_sw.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c index 939d1673f508..0513f82b8537 100644 --- a/net/tls/tls_sw.c +++ b/net/tls/tls_sw.c @@ -1837,15 +1837,17 @@ int tls_sw_recvmsg(struct sock *sk, bool partially_consumed = chunk > len; if (bpf_strp_enabled) { + /* BPF may try to queue the skb */ + __skb_unlink(skb, &ctx->rx_list); err = sk_psock_tls_strp_read(psock, skb); if (err != __SK_PASS) { rxm->offset = rxm->offset + rxm->full_len; rxm->full_len = 0; - __skb_unlink(skb, &ctx->rx_list); if (err == __SK_DROP) consume_skb(skb); continue; } + __skb_queue_tail(&ctx->rx_list, skb); } if (partially_consumed) -- 2.34.3