On Wed, Aug 6, 2025 at 1:20 PM Jakub Kicinski <[email protected]> wrote:
>
> On Wed, 6 Aug 2025 11:35:28 -0700 Eric Dumazet wrote:
> > > TLS expects that it owns the receive queue of the TCP socket.
> > > This cannot be guaranteed in case the reader of the TCP socket
> > > entered before the TLS ULP was installed, or uses some non-standard
> > > read API (eg. zerocopy ones). Make sure that the TCP sequence
> > > numbers match between ->data_ready and ->recvmsg, otherwise
> > > don't trust the work that ->data_ready has done.
> > >
> > > Signed-off-by: William Liu <[email protected]>
> > > Signed-off-by: Savino Dicanosa <[email protected]>
> >
> > I presume you meant Reported-by tags ?
>
> Oops..
>
> > > Link:
> > > https://lore.kernel.org/tFjq_kf7sWIG3A7CrCg_egb8CVsT_gsmHAK0_wxDPJXfIzxFAMxqmLwp3MlU5EHiet0AwwJldaaFdgyHpeIUCS-3m3llsmRzp9xIOBR4lAI=@syst3mfailure.io
> > > Fixes: 84c61fe1a75b ("tls: rx: do not use the standard strparser")
> > > Signed-off-by: Jakub Kicinski <[email protected]>
> > > ---
> > > include/net/tls.h | 1 +
> > > net/tls/tls.h | 2 +-
> > > net/tls/tls_strp.c | 17 ++++++++++++++---
> > > net/tls/tls_sw.c | 3 ++-
> > > 4 files changed, 18 insertions(+), 5 deletions(-)
> > >
> > > diff --git a/include/net/tls.h b/include/net/tls.h
> > > index 857340338b69..37344a39e4c9 100644
> > > --- a/include/net/tls.h
> > > +++ b/include/net/tls.h
> > > @@ -117,6 +117,7 @@ struct tls_strparser {
> > > bool msg_ready;
> > >
> > > struct strp_msg stm;
> > > + u32 copied_seq;
> >
> > Can a 2^32 wrap occur eventually ?
>
> Hm, good point. Is it good enough if we also check it in data_ready?
> That way we should notice that someone is eating our data before
> the seq had a chance to wrap?
I could not understand what your suggestion was.
Perhaps store both copued_seq and tp->bytes_received and
check if (tp->bytes_received - strp->bytes_received) is smaller than 2^31 .
if (unlikely(strp->copied_seq != tp->copied_seq ||
(tp->bytes_received -
strp->bytes_received >= (1ULL < 31)) ||
WARN_ON(tcp_inq(strp->sk) < strp->stm.full_len))) {
