From patchwork Tue Nov 3 20:35:01 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 317106 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id D2C14C388F7 for ; Tue, 3 Nov 2020 21:05:01 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 7D60922226 for ; Tue, 3 Nov 2020 21:05:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1604437501; bh=FD9pNP4izVVvDGZgBFNR/ecRqnGuP3Ya3ZqocDXOD3k=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=wFxNjMa/zRcFfbSsF03PRVNP4MP+RsBqLKQEgEH9y6Iq7BwhmOilQ61vcQJxiM0DM j9jNhtOkFewKcE0EPAOg6NaVwOqD/NH2gt0lhKW15SfiiW6yJSA8JG2w0iQ+Z3sjlt fi6d6WhTS4agkNB9JUOhJJsdtyu67OgE8/aE6/mE= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2387701AbgKCVCw (ORCPT ); Tue, 3 Nov 2020 16:02:52 -0500 Received: from mail.kernel.org ([198.145.29.99]:40108 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1733101AbgKCVCw (ORCPT ); Tue, 3 Nov 2020 16:02:52 -0500 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 9F91820658; Tue, 3 Nov 2020 21:02:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1604437370; bh=FD9pNP4izVVvDGZgBFNR/ecRqnGuP3Ya3ZqocDXOD3k=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=RXUklTkCXRYR9bE/Aj2Bin2qr21GoE8x4ngox0/O/U/pKAXF/Uy5Y5e2G1vvsYUPB MPqV5LFjNR8kXN4/o1bz1UN+31pWlocjFw6hhs/dRZ9+Zb4FiHih1BcLUmbNG6UupN z8B5pwq3vcQ0VmRRHi45bvM49JYbncUBpF1s1OiY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Vinay Kumar Yadav , Jakub Kicinski Subject: [PATCH 4.19 009/191] chelsio/chtls: fix tls record info to user Date: Tue, 3 Nov 2020 21:35:01 +0100 Message-Id: <20201103203233.869913919@linuxfoundation.org> X-Mailer: git-send-email 2.29.2 In-Reply-To: <20201103203232.656475008@linuxfoundation.org> References: <20201103203232.656475008@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Vinay Kumar Yadav [ Upstream commit 4f3391ce8f5a69e7e6d66d0a3fc654eb6dbdc919 ] chtls_pt_recvmsg() receives a skb with tls header and subsequent skb with data, need to finalize the data copy whenever next skb with tls header is available. but here current tls header is overwritten by next available tls header, ends up corrupting user buffer data. fixing it by finalizing current record whenever next skb contains tls header. v1->v2: - Improved commit message. Fixes: 17a7d24aa89d ("crypto: chtls - generic handling of data and hdr") Signed-off-by: Vinay Kumar Yadav Link: https://lore.kernel.org/r/20201022190556.21308-1-vinay.yadav@chelsio.com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman --- drivers/crypto/chelsio/chtls/chtls_io.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) --- a/drivers/crypto/chelsio/chtls/chtls_io.c +++ b/drivers/crypto/chelsio/chtls/chtls_io.c @@ -1549,6 +1549,7 @@ skip_copy: tp->urg_data = 0; if ((avail + offset) >= skb->len) { + struct sk_buff *next_skb; if (ULP_SKB_CB(skb)->flags & ULPCB_FLAG_TLS_HDR) { tp->copied_seq += skb->len; hws->rcvpld = skb->hdr_len; @@ -1558,8 +1559,10 @@ skip_copy: chtls_free_skb(sk, skb); buffers_freed++; hws->copied_seq = 0; - if (copied >= target && - !skb_peek(&sk->sk_receive_queue)) + next_skb = skb_peek(&sk->sk_receive_queue); + if (copied >= target && !next_skb) + break; + if (ULP_SKB_CB(next_skb)->flags & ULPCB_FLAG_TLS_HDR) break; } } while (len > 0);