Merge branch 'net-tls-fail-splice-after-a-failed-async-decrypt'

Browse source

Chuck Lever says:

====================
net/tls: Fail splice after a failed async decrypt

tls_sw_recvmsg() and tls_sw_read_sock() both read ctx->async_wait.err
once they hold the reader lock, so a record that failed
authentication fails the call. tls_sw_splice_read() has no such
check. sk_err does not stand in for one. The first reader to reach
sock_error() clears sk_err, while async_wait.err persists. A splice
therefore keeps delivering records on a connection the other two
readers have already refused.

Both patches come from a receive-path series for zero-length data
records. Jakub asked for them separately, since the rest of that
series is still under discussion.

Link to the original series:
https://patch.msgid.link/20260726-tls-follow-on-v1-0-99bf4cc1c729@kernel.org
====================

Link: https://patch.msgid.link/20260806-tls-splice-crypto-fix-v1-0-a2624005a286@kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>

...

This commit is contained in:

Paolo Abeni 2026-08-11 15:39:02 +02:00

parent 5f3a13e0bb 8a42229739

commit 71b3ced504

2 changed files with 70 additions and 10 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

5

net/tls/tls_sw.c

View file

75

tools/testing/selftests/net/tls.c

View file