| Message ID | e094325019f7fd960470c10efda41c1b7f9bc54f.1694018970.git.sd@queasysnail.net (mailing list archive) |
|---|---|
| State | Changes Requested |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | tls: fix some issues with async encryption | expand |
diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c index babbd43d41ed..f80a2ea1dd7e 100644 --- a/net/tls/tls_sw.c +++ b/net/tls/tls_sw.c @@ -2116,6 +2116,9 @@ int tls_sw_recvmsg(struct sock *sk, ret = 0; if (pending) ret = crypto_wait_req(-EINPROGRESS, &ctx->async_wait); + /* Crypto completion could have run before us, check sk_err */ + if (ret == 0) + ret = -sk->sk_err; __skb_queue_purge(&ctx->async_hold); if (ret) {
In case a corrupted record is decrypted asynchronously, the error can be reported in two ways: - via the completion's error mechanism - via sk->sk_err If all asynchronous decrypts finish before we reach the end of tls_sw_recvmsg, decrypt_pending will be 0 and we don't check the completion for errors. We should still check sk->sk_err, otherwise we'll miss the error and return garbage to userspace. This is visible in the bad_auth test case. Fixes: 94524d8fc965 ("net/tls: Add support for async decryption of tls records") Signed-off-by: Sabrina Dubroca <sd@queasysnail.net> --- net/tls/tls_sw.c | 3 +++ 1 file changed, 3 insertions(+)