From patchwork Sat Jan 13 00:32:57 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: John Fastabend X-Patchwork-Id: 13518794 X-Patchwork-Delegate: kuba@kernel.org Received: from mail-ot1-f47.google.com (mail-ot1-f47.google.com [209.85.210.47]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 33C3EF4F9; Sat, 13 Jan 2024 00:33:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Tys6gv/h" Received: by mail-ot1-f47.google.com with SMTP id 46e09a7af769-6e0a64d9449so544862a34.2; Fri, 12 Jan 2024 16:33:03 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1705105982; x=1705710782; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=lHteaZbYIt3DkRc+UM6Ay3q+ahKAfTLz4hpmurqAk4U=; b=Tys6gv/hjNDHkqtbHe1l9sMfB9UF1tlBA6bULWfpcnQy/euB7WAHWcJSy2A+wrKQ40 MRCwLm9JnI5lUmRCcO/+RxpcIXrrhsI0tEp+NbQprZAEcflt8CMHEA7jOqLnYFH5O3oP auIL/cUaS7EzizyYN6SN46UjscJ32odaDGMZKxbOT3hAmSmPnE6jqmRcjwK4Af+KNBJO NGF3hSB0lAAK/TMFDGwOcjFHNqYra0RkXjzybHoh0+7RuPJN0bbrrU8bCGJEpaMuYql9 Ompch0Q2ZottkXPjoBfCtxqSTL8HPhnQJUeQUbbWNbNPaTBIp53HyV3zgbIvFvJd3r5o ydVA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1705105982; x=1705710782; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=lHteaZbYIt3DkRc+UM6Ay3q+ahKAfTLz4hpmurqAk4U=; b=qVo/voOrCYNAByMkDHVTNOZ+B1Ie7PxwUYKze8EUwCZAC3fLHq0MzGzSnfI+T7eRz+ 6A8rDGxxyPj9p/DKOhIqBC8nbc/iMZYj77rFviyHcenBk6K/vGHAvhd89iklj6tZ786Z HPa5/ch0Fr11zllWLoituOxMyGyi9k3dl3Gn1FeQukthz7UHnz3WjGoIf7HcZxz4kkvT vsdFV33rZuon2U/JlxI6n06mJyh0WGlEB6NYOjY/FKg+g375PtecAwVdvNyQF4PwNd0q B5uhmLs22aqbMeJ6oGC/rbxKLZruk9AzsAvGKDO+JR4LCRmpyFpZX7h2PZRdxSrvjfFk enZA== X-Gm-Message-State: AOJu0YyATx2/Wix2QKfWk4ujDgPAHNPs9DbEunFQchtsW9iNNWppM8Wl 8xbfAmZzJJ7HFZsBUPQOQcINGTcuikE= X-Google-Smtp-Source: AGHT+IEOWlIikG/Ni5c2xjpWA+JEh9Cm1fBM4ylF2YonpxilKHs6oY8ayaNBH9tXPQ+ccT10lx6CoQ== X-Received: by 2002:a05:6830:128a:b0:6db:fee1:f4a8 with SMTP id z10-20020a056830128a00b006dbfee1f4a8mr2795203otp.2.1705105982143; Fri, 12 Jan 2024 16:33:02 -0800 (PST) Received: from john.. ([98.97.116.126]) by smtp.gmail.com with ESMTPSA id x8-20020aa79a48000000b006d9b35b2602sm3707914pfj.3.2024.01.12.16.33.00 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 12 Jan 2024 16:33:01 -0800 (PST) From: John Fastabend To: netdev@vger.kernel.org, eadavis@qq.com, kuba@kernel.org Cc: john.fastabend@gmail.com, bpf@vger.kernel.org, borisp@nvidia.com Subject: [PATCH net v2 1/2] net: tls, fix WARNIING in __sk_msg_free Date: Fri, 12 Jan 2024 16:32:57 -0800 Message-Id: <20240113003258.67899-2-john.fastabend@gmail.com> X-Mailer: git-send-email 2.33.0 In-Reply-To: <20240113003258.67899-1-john.fastabend@gmail.com> References: <20240113003258.67899-1-john.fastabend@gmail.com> Precedence: bulk X-Mailing-List: bpf@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Patchwork-Delegate: kuba@kernel.org A splice with MSG_SPLICE_PAGES will cause tls code to use the tls_sw_sendmsg_splice path in the TLS sendmsg code to move the user provided pages from the msg into the msg_pl. This will loop over the msg until msg_pl is full, checked by sk_msg_full(msg_pl). The user can also set the MORE flag to hint stack to delay sending until receiving more pages and ideally a full buffer. If the user adds more pages to the msg than can fit in the msg_pl scatterlist (MAX_MSG_FRAGS) we should ignore the MORE flag and send the buffer anyways. What actually happens though is we abort the msg to msg_pl scatterlist setup and then because we forget to set 'full record' indicating we can no longer consume data without a send we fallthrough to the 'continue' path which will check if msg_data_left(msg) has more bytes to send and then attempts to fit them in the already full msg_pl. Then next iteration of sender doing send will encounter a full msg_pl and throw the warning in the syzbot report. To fix simply check if we have a full_record in splice code path and if not send the msg regardless of MORE flag. Reported-and-tested-by: syzbot+f2977222e0e95cec15c8@syzkaller.appspotmail.com Reported-by: Edward Adam Davis Fixes: fe1e81d4f73b ("tls/sw: Support MSG_SPLICE_PAGES") Reviewed-by: Jakub Kicinski Signed-off-by: John Fastabend --- net/tls/tls_sw.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c index e37b4d2e2acd..31e8a94dfc11 100644 --- a/net/tls/tls_sw.c +++ b/net/tls/tls_sw.c @@ -1052,7 +1052,11 @@ static int tls_sw_sendmsg_locked(struct sock *sk, struct msghdr *msg, if (ret < 0) goto send_end; tls_ctx->pending_open_record_frags = true; - if (full_record || eor || sk_msg_full(msg_pl)) + + if (sk_msg_full(msg_pl)) + full_record = true; + + if (full_record || eor) goto copied; continue; } From patchwork Sat Jan 13 00:32:58 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: John Fastabend X-Patchwork-Id: 13518795 X-Patchwork-Delegate: kuba@kernel.org Received: from mail-pf1-f172.google.com (mail-pf1-f172.google.com [209.85.210.172]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1B50510953; Sat, 13 Jan 2024 00:33:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="FZIPOLVr" Received: by mail-pf1-f172.google.com with SMTP id d2e1a72fcca58-6d9a795cffbso5289174b3a.0; Fri, 12 Jan 2024 16:33:05 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1705105984; x=1705710784; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=2nypTy6NkHYIvARCP+pxxumVbbKshlAVhi7kz7hPbnU=; b=FZIPOLVrCD807DMBx2mexN5j7U2yOqTTEq3hP25pSF81Pk2l6C+sPQL8tEWI4gioOL h/dIrjnEy30fxhvxc0EACAMkxupfgZG1TE0Rd6WjtH9PGrRhftH8brcSNh602z8e4h9h GoSih5CzyAG7iWddUwUuCLYc3RzVE4B/rnFAtADzuwk6ifqfDRhLnC9lNA2YAaYq52J1 t0oe1uS7Yw62bBjyqnE0FH1aPcdZsbwseIvx6R424/FW1rTL6BryGvjJnjiEXyeFOF0V 2WM0JZlXZhb1+zWHsexTzk8Vbfn3NzwdDgiyq3Ptdwuidsb/mJRbECgm43re1QD7+bXi 8ycA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1705105984; x=1705710784; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=2nypTy6NkHYIvARCP+pxxumVbbKshlAVhi7kz7hPbnU=; b=iDOIZ8JYYn4xuFbXe2gCoNz6WxNyWSQ/2HrV1F5cps+9Kp740xrBEVQ78UZoAw468e kIhByrUl7/YcgJtzGUNK5Yg4u/b+LCpRRXONkqg3W3J/Aw95aS9TmFjXKNGFYLKwmmTz AH7UxOEJJMU7alBMLqEWzAJDZmUnlfkEcBubkExDdLmGjndzkDfG+V5eQRPp2TzvCySG lOVLrrZr4K89EZw1jHuRFwkPsn0MlXhQS1eLEaMnaSPoZPHqIaAOlRHsJ8hJmWqllvPd 9e/ae0cvRw+aRiMFVUf2v8QBe+bqGgrO7uCKGdIz17oyuHlP7I2lrVVTnBOzlKnZGvvr lBGw== X-Gm-Message-State: AOJu0YyNSs1klely4/JbqG0opvYQQY+vMtD95n3VNHAd7KWruXRSrxEO kQuSHWguGKdhJDnh2YEclskWGrooBzE= X-Google-Smtp-Source: AGHT+IEVbqZ3C4bnKqixDhyrowxeVrt8WlYMx5BOv4LGkra7Qy30ae2mBqhcCOu8PCEvsNjhi8y0mA== X-Received: by 2002:a05:6a00:986:b0:6da:de0:9bf0 with SMTP id u6-20020a056a00098600b006da0de09bf0mr2635076pfg.26.1705105984275; Fri, 12 Jan 2024 16:33:04 -0800 (PST) Received: from john.. ([98.97.116.126]) by smtp.gmail.com with ESMTPSA id x8-20020aa79a48000000b006d9b35b2602sm3707914pfj.3.2024.01.12.16.33.02 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 12 Jan 2024 16:33:02 -0800 (PST) From: John Fastabend To: netdev@vger.kernel.org, eadavis@qq.com, kuba@kernel.org Cc: john.fastabend@gmail.com, bpf@vger.kernel.org, borisp@nvidia.com Subject: [PATCH net v2 2/2] net: tls, add test to capture error on large splice Date: Fri, 12 Jan 2024 16:32:58 -0800 Message-Id: <20240113003258.67899-3-john.fastabend@gmail.com> X-Mailer: git-send-email 2.33.0 In-Reply-To: <20240113003258.67899-1-john.fastabend@gmail.com> References: <20240113003258.67899-1-john.fastabend@gmail.com> Precedence: bulk X-Mailing-List: bpf@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Patchwork-Delegate: kuba@kernel.org syzbot found an error with how splice() is handled with a msg greater than 32. This was fixed in previous patch, but lets add a test for it to ensure it continues to work. Signed-off-by: John Fastabend Reviewed-by: Jakub Kicinski --- tools/testing/selftests/net/tls.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/tools/testing/selftests/net/tls.c b/tools/testing/selftests/net/tls.c index 464853a7f982..7799e042a971 100644 --- a/tools/testing/selftests/net/tls.c +++ b/tools/testing/selftests/net/tls.c @@ -707,6 +707,20 @@ TEST_F(tls, splice_from_pipe) EXPECT_EQ(memcmp(mem_send, mem_recv, send_len), 0); } +TEST_F(tls, splice_more) +{ + unsigned int f = SPLICE_F_NONBLOCK | SPLICE_F_MORE | SPLICE_F_GIFT; + int send_len = TLS_PAYLOAD_MAX_LEN; + char mem_send[TLS_PAYLOAD_MAX_LEN]; + int i, send_pipe = 1; + int p[2]; + + ASSERT_GE(pipe(p), 0); + EXPECT_GE(write(p[1], mem_send, send_len), 0); + for (i = 0; i < 32; i++) + EXPECT_EQ(splice(p[0], NULL, self->fd, NULL, send_pipe, f), 1); +} + TEST_F(tls, splice_from_pipe2) { int send_len = 16000;