From patchwork Wed Jun 7 18:19:11 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: David Howells X-Patchwork-Id: 13271091 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 94C15C7EE23 for ; Wed, 7 Jun 2023 18:20:07 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 1C813900005; Wed, 7 Jun 2023 14:20:07 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 1516D900004; Wed, 7 Jun 2023 14:20:07 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id F0D5E900005; Wed, 7 Jun 2023 14:20:06 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0012.hostedemail.com [216.40.44.12]) by kanga.kvack.org (Postfix) with ESMTP id DB41C900004 for ; Wed, 7 Jun 2023 14:20:06 -0400 (EDT) Received: from smtpin29.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay09.hostedemail.com (Postfix) with ESMTP id 8C7AD80353 for ; Wed, 7 Jun 2023 18:20:06 +0000 (UTC) X-FDA: 80876766012.29.E11E143 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by imf19.hostedemail.com (Postfix) with ESMTP id 9F4C11A0002 for ; Wed, 7 Jun 2023 18:20:04 +0000 (UTC) Authentication-Results: imf19.hostedemail.com; dkim=pass header.d=redhat.com header.s=mimecast20190719 header.b=GVv0lUv+; dmarc=pass (policy=none) header.from=redhat.com; spf=pass (imf19.hostedemail.com: domain of dhowells@redhat.com designates 170.10.129.124 as permitted sender) smtp.mailfrom=dhowells@redhat.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1686162004; a=rsa-sha256; cv=none; b=NlWq0Asr01m+vKvIEOWj5QDNq7yx/T81R8xi1LT3rtirh3LS72J87nMbpMNH/eV1QBJNAu ia2R0ET1kZEt2Mvv9JMY2LmjxbtBbnjHjUCVjuq9GtgrZjocBt1IpaIN9IonInrnxLJQ5E YDDW+pMrNG2Y9LVQQbqyHXnKij4CO3o= ARC-Authentication-Results: i=1; imf19.hostedemail.com; dkim=pass header.d=redhat.com header.s=mimecast20190719 header.b=GVv0lUv+; dmarc=pass (policy=none) header.from=redhat.com; spf=pass (imf19.hostedemail.com: domain of dhowells@redhat.com designates 170.10.129.124 as permitted sender) smtp.mailfrom=dhowells@redhat.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1686162004; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=XqvSAbXVPa8XwKzNr0PvZXw2FsrUtjvMm73oMSig34E=; b=w5hi/gzv5tXf1pBUfLwrM/lTzhL9/ifel/9Dx8LEOQMLjv+0mF2+44koCX1HKh3Qfb6CSV HLu++dawdxGiVfJaTqG/P0Y7JedyoXE8FO3RCDP4q1C+ZlgGb43hePf4H5O7tnOvD+5ANr Bx6ddxQ76q69MLD8kA1al7CXaecvDPo= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1686162003; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=XqvSAbXVPa8XwKzNr0PvZXw2FsrUtjvMm73oMSig34E=; b=GVv0lUv+mi+vUq/sBMaukckmfGHxoogweveadMhrWZ3LpExnFMvF37ghL/qj1l+ooI04fJ y2m+YGcEsFUJS0Q9B8pOnM2uo54Q1RTfQP49NePpN2ZcW09lAZSGcARH18xr/43HScy16E qT2yw5L6ST/5cVeot4UTAAprUdwZfLs= Received: from mimecast-mx02.redhat.com (mx3-rdu2.redhat.com [66.187.233.73]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-617-EoBIkxF_MvKXdSL0ouQGYQ-1; Wed, 07 Jun 2023 14:20:00 -0400 X-MC-Unique: EoBIkxF_MvKXdSL0ouQGYQ-1 Received: from smtp.corp.redhat.com (int-mx06.intmail.prod.int.rdu2.redhat.com [10.11.54.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id A04B23806704; Wed, 7 Jun 2023 18:19:59 +0000 (UTC) Received: from warthog.procyon.org.uk (unknown [10.42.28.182]) by smtp.corp.redhat.com (Postfix) with ESMTP id 249F82166B25; Wed, 7 Jun 2023 18:19:41 +0000 (UTC) From: David Howells To: netdev@vger.kernel.org, Linus Torvalds Cc: David Howells , Chuck Lever , Boris Pismenny , John Fastabend , Jakub Kicinski , "David S. Miller" , Eric Dumazet , Paolo Abeni , Willem de Bruijn , David Ahern , Matthew Wilcox , Jens Axboe , linux-mm@kvack.org, linux-kernel@vger.kernel.org Subject: [PATCH net-next v6 05/14] tls/sw: Use splice_eof() to flush Date: Wed, 7 Jun 2023 19:19:11 +0100 Message-ID: <20230607181920.2294972-6-dhowells@redhat.com> In-Reply-To: <20230607181920.2294972-1-dhowells@redhat.com> References: <20230607181920.2294972-1-dhowells@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.1 on 10.11.54.6 X-Rspam-User: X-Rspamd-Server: rspam06 X-Rspamd-Queue-Id: 9F4C11A0002 X-Stat-Signature: jjpc4ay9rwetybkdisp1xz19yisukejk X-HE-Tag: 1686162004-739047 X-HE-Meta: U2FsdGVkX1+RH218h5WSew5DOUh2IC9QfK/POCYry/L2Bz6hpcImJ2C49tIHLqeT70hx6JSpjq21YeLY54qkXSeVLr81/icWbbDLTo3uJmjb04RhqTmNuj8ho2Y6V6ToaeFHYH1A5wZ6y2P1m4lEn9cdOJ8eo4LaMMfriVTJJz/2EgcEPbreZ+KgSvkzT0ZLCGxK7m9DtVIoDDsH+W4SgbZoGj56Pl31srNvv68J50nGb3qiq1f6uaLRfvZuy3d8IEt6qEAuPHpmp0hED+Iczo/Dv5uZY3v7g7gtgFL2dq9vKclDEFQnjdETVvDMkTAcbtOs7nUaBoIIQMykdF3QnvPHenhbcyqWRyCmfz8sT5EKwpngzMU7DiI0eTmWN34HL8a/XSaxKyOBRgUzO8E37Y1qC4bTJ79654IxKk/hGmbkdwdONLGBCDTgWOqdCiB5urfWrclCWFi2Ybo6Z1cNsiFPQgWMasB2ei1uGERVm6gg8QXMFHUSilkT48YbInv0sTdco9B7//uTJ8DCiUzXt2n3uSoKcwh3aLI6TAKxG2RUDxPK/pYL1DWMIUFIB46ETUk4kkodn+m8L9bjKNYniaUSrgluewwBywRayOOXbiNTVNvInyn8bUypBLKOLgk7WCSOGqbdDzufhwpe30DaH4/h2V2fre+SDsrdTJICQm+me4LQNzdrADxu+w4ii/5y87dcteY2fPwUSaxQsm5WnKqt++YkSdoYoE3jk5QRumDtyGd1CB1MapdSwHJGLrOljn2lU1HD+3K1wyFsNIbbIeCQ1p8HlYIXfxYhQ5QSYDyaCV4z/NfpcNqsx+ZreC/B17ewEgiCRV0TStTlClDqy31VQfKSm/IE4PFpZIO3AbNIsoC+JrXTjRmHN5d1hyjXvQ5SA4ilaZhZ+6/bJ51Jaxsbg301KP9LZC1bptRKkZnCvuqnG4wPHdfWujH9etGyUB/FJ66Xhb0fC/NXKI1 B+XAtcPx aLfsB+7f9EQrf0RdqQCUCtnIu1FL0RmfLc1ki/DTdcZAM+RZu2/cFOmblJWvz3oD8epx9ZllfVmbduoNRV2jAKr3r3LjHF7zDf9ks4mUeCo+mTAKOwqLqquBC5qGcP6E9eSrt06AbSaLY21bxVSCMWEBKYOc2nEhyvcNuQRshmw9dFyhpJdwzVD8GjcEgaeIDtWdlN8mqo/IjBo0oesML+N3R7dUZXv6iNc9UjzSVRgPFJgx3IkWduKTNgkSyGVH1w7zdnBF2ZW4X275Crxf8CUX7sleQiizRiB2Q8BG7tUCUw9ARlNbr6APfEQ20ZteyK+MQ508RFQUL2w0Hjg+d/H7UpXKXPPANDRONSPN1qwcHlYAbiSv+pEP0Cr+dKVVhB82jwawoDJgi3O5+f8DUn2f1ARe/GEH0xU62h1teEyxlzPkQSCs6Ind+JAK0rMnjLMvR6SEqr2XADMWqXZujzqJH0R83RamzArdBmj4Y7s0ntqu7CHouqPqoHdHYAGmVJen33bzVO5U6ro8f0eiC3HepKpxrm623a7geBUu+fovJDT63P+PvyrdLTlQUMiN18qvl3gvhBU1LK7INK2XDzqXVD3Xpv0W5lZzi5vCOj3nKYHpMXt2fhB+IAQ== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: Allow splice to end a TLS record after prematurely ending a splice/sendfile due to getting an EOF condition (->splice_read() returned 0) after splice had called TLS with a sendmsg() with MSG_MORE set when the user didn't set MSG_MORE. Suggested-by: Linus Torvalds Link: https://lore.kernel.org/r/CAHk-=wh=V579PDYvkpnTobCLGczbgxpMgGmmhqiTyE34Cpi5Gg@mail.gmail.com/ Signed-off-by: David Howells Reviewed-by: Jakub Kicinski cc: Chuck Lever cc: Boris Pismenny cc: John Fastabend cc: Eric Dumazet cc: "David S. Miller" cc: Paolo Abeni cc: Jens Axboe cc: Matthew Wilcox cc: netdev@vger.kernel.org --- net/tls/tls.h | 1 + net/tls/tls_main.c | 2 ++ net/tls/tls_sw.c | 74 ++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 77 insertions(+) diff --git a/net/tls/tls.h b/net/tls/tls.h index 0672acab2773..4922668fefaa 100644 --- a/net/tls/tls.h +++ b/net/tls/tls.h @@ -97,6 +97,7 @@ void tls_update_rx_zc_capable(struct tls_context *tls_ctx); void tls_sw_strparser_arm(struct sock *sk, struct tls_context *ctx); void tls_sw_strparser_done(struct tls_context *tls_ctx); int tls_sw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size); +void tls_sw_splice_eof(struct socket *sock); int tls_sw_sendpage_locked(struct sock *sk, struct page *page, int offset, size_t size, int flags); int tls_sw_sendpage(struct sock *sk, struct page *page, diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c index e02a0d882ed3..82ec5c654f32 100644 --- a/net/tls/tls_main.c +++ b/net/tls/tls_main.c @@ -957,6 +957,7 @@ static void build_proto_ops(struct proto_ops ops[TLS_NUM_CONFIG][TLS_NUM_CONFIG] ops[TLS_BASE][TLS_BASE] = *base; ops[TLS_SW ][TLS_BASE] = ops[TLS_BASE][TLS_BASE]; + ops[TLS_SW ][TLS_BASE].splice_eof = tls_sw_splice_eof; ops[TLS_SW ][TLS_BASE].sendpage_locked = tls_sw_sendpage_locked; ops[TLS_BASE][TLS_SW ] = ops[TLS_BASE][TLS_BASE]; @@ -1027,6 +1028,7 @@ static void build_protos(struct proto prot[TLS_NUM_CONFIG][TLS_NUM_CONFIG], prot[TLS_SW][TLS_BASE] = prot[TLS_BASE][TLS_BASE]; prot[TLS_SW][TLS_BASE].sendmsg = tls_sw_sendmsg; + prot[TLS_SW][TLS_BASE].splice_eof = tls_sw_splice_eof; prot[TLS_SW][TLS_BASE].sendpage = tls_sw_sendpage; prot[TLS_BASE][TLS_SW] = prot[TLS_BASE][TLS_BASE]; diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c index 38acc27a0dd0..a2fb0256ff1c 100644 --- a/net/tls/tls_sw.c +++ b/net/tls/tls_sw.c @@ -1157,6 +1157,80 @@ int tls_sw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size) return copied > 0 ? copied : ret; } +/* + * Handle unexpected EOF during splice without SPLICE_F_MORE set. + */ +void tls_sw_splice_eof(struct socket *sock) +{ + struct sock *sk = sock->sk; + struct tls_context *tls_ctx = tls_get_ctx(sk); + struct tls_sw_context_tx *ctx = tls_sw_ctx_tx(tls_ctx); + struct tls_rec *rec; + struct sk_msg *msg_pl; + ssize_t copied = 0; + bool retrying = false; + int ret = 0; + int pending; + + if (!ctx->open_rec) + return; + + mutex_lock(&tls_ctx->tx_lock); + lock_sock(sk); + +retry: + rec = ctx->open_rec; + if (!rec) + goto unlock; + + msg_pl = &rec->msg_plaintext; + + /* Check the BPF advisor and perform transmission. */ + ret = bpf_exec_tx_verdict(msg_pl, sk, false, TLS_RECORD_TYPE_DATA, + &copied, 0); + switch (ret) { + case 0: + case -EAGAIN: + if (retrying) + goto unlock; + retrying = true; + goto retry; + case -EINPROGRESS: + break; + default: + goto unlock; + } + + /* Wait for pending encryptions to get completed */ + spin_lock_bh(&ctx->encrypt_compl_lock); + ctx->async_notify = true; + + pending = atomic_read(&ctx->encrypt_pending); + spin_unlock_bh(&ctx->encrypt_compl_lock); + if (pending) + crypto_wait_req(-EINPROGRESS, &ctx->async_wait); + else + reinit_completion(&ctx->async_wait.completion); + + /* There can be no concurrent accesses, since we have no pending + * encrypt operations + */ + WRITE_ONCE(ctx->async_notify, false); + + if (ctx->async_wait.err) + goto unlock; + + /* Transmit if any encryptions have completed */ + if (test_and_clear_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask)) { + cancel_delayed_work(&ctx->tx_work.work); + tls_tx_records(sk, 0); + } + +unlock: + release_sock(sk); + mutex_unlock(&tls_ctx->tx_lock); +} + static int tls_sw_do_sendpage(struct sock *sk, struct page *page, int offset, size_t size, int flags) {