[PATCH net-next] net: tls: fix messing up lists when bpf enabled

[PATCH net-next] net: tls: fix messing up lists when bpf enabled

[Jakub Kicinski]

Artem points out that skb may try to take over the skb and
queue it to its own list. Unlink the skb before calling out.

Fixes: b1a2c1786330 ("tls: rx: clear ctx->recv_pkt earlier")
Reported-by: Artem Savkov <asavkov@redhat.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---
CC: borisp@nvidia.com
CC: john.fastabend@gmail.com
CC: daniel@iogearbox.net
---
 net/tls/tls_sw.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
index 939d1673f508..0513f82b8537 100644
--- a/net/tls/tls_sw.c
+++ b/net/tls/tls_sw.c
@@ -1837,15 +1837,17 @@ int tls_sw_recvmsg(struct sock *sk,
 			bool partially_consumed = chunk > len;
 
 			if (bpf_strp_enabled) {
+				/* BPF may try to queue the skb */
+				__skb_unlink(skb, &ctx->rx_list);
 				err = sk_psock_tls_strp_read(psock, skb);
 				if (err != __SK_PASS) {
 					rxm->offset = rxm->offset + rxm->full_len;
 					rxm->full_len = 0;
-					__skb_unlink(skb, &ctx->rx_list);
 					if (err == __SK_DROP)
 						consume_skb(skb);
 					continue;
 				}
+				__skb_queue_tail(&ctx->rx_list, skb);
 			}
 
 			if (partially_consumed)
-- 
2.34.3

Re: [PATCH net-next] net: tls: fix messing up lists when bpf enabled

[Artem Savkov]

On Wed, May 18, 2022 at 01:56:44PM -0700, Jakub Kicinski wrote:
> Artem points out that skb may try to take over the skb and
                        ^^^ I think you meant "bpf"

> queue it to its own list. Unlink the skb before calling out.
> 
> Fixes: b1a2c1786330 ("tls: rx: clear ctx->recv_pkt earlier")
> Reported-by: Artem Savkov <asavkov@redhat.com>
Tested-by: Artem Savkov <asavkov@redhat.com>

> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
> ---
> CC: borisp@nvidia.com
> CC: john.fastabend@gmail.com
> CC: daniel@iogearbox.net
> ---
>  net/tls/tls_sw.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
> index 939d1673f508..0513f82b8537 100644
> --- a/net/tls/tls_sw.c
> +++ b/net/tls/tls_sw.c
> @@ -1837,15 +1837,17 @@ int tls_sw_recvmsg(struct sock *sk,
>  			bool partially_consumed = chunk > len;
>  
>  			if (bpf_strp_enabled) {
> +				/* BPF may try to queue the skb */
> +				__skb_unlink(skb, &ctx->rx_list);
>  				err = sk_psock_tls_strp_read(psock, skb);
>  				if (err != __SK_PASS) {
>  					rxm->offset = rxm->offset + rxm->full_len;
>  					rxm->full_len = 0;
> -					__skb_unlink(skb, &ctx->rx_list);
>  					if (err == __SK_DROP)
>  						consume_skb(skb);
>  					continue;
>  				}
> +				__skb_queue_tail(&ctx->rx_list, skb);
>  			}
>  
>  			if (partially_consumed)
> -- 
> 2.34.3
> 

-- 
 Artem

Re: [PATCH net-next] net: tls: fix messing up lists when bpf enabled

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net-next.git (master)
by Jakub Kicinski <kuba@kernel.org>:

On Wed, 18 May 2022 13:56:44 -0700 you wrote:
> Artem points out that skb may try to take over the skb and
> queue it to its own list. Unlink the skb before calling out.
> 
> Fixes: b1a2c1786330 ("tls: rx: clear ctx->recv_pkt earlier")
> Reported-by: Artem Savkov <asavkov@redhat.com>
> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
> 
> [...]

Here is the summary with links:
  - [net-next] net: tls: fix messing up lists when bpf enabled
    https://git.kernel.org/netdev/net-next/c/1c2133114d2d

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html