summaryrefslogtreecommitdiffstats
path: root/net/tls
diff options
context:
space:
mode:
authorJakub Kicinski <kuba@kernel.org>2023-05-16 18:50:39 -0700
committerDavid S. Miller <davem@davemloft.net>2023-05-19 08:37:37 +0100
commit8b0c0dc9fbbd01e58a573a41c38885f9e4c17696 (patch)
tree2ec68efdb46ec7dc04a675a43b747b74e8275a8a /net/tls
parent14c4be92ebb3e36e392aa9dd8f314038a9f96f3c (diff)
downloadlinux-8b0c0dc9fbbd01e58a573a41c38885f9e4c17696.tar.gz
linux-8b0c0dc9fbbd01e58a573a41c38885f9e4c17696.tar.bz2
linux-8b0c0dc9fbbd01e58a573a41c38885f9e4c17696.zip
tls: rx: strp: fix determining record length in copy mode
We call tls_rx_msg_size(skb) before doing skb->len += chunk. So the tls_rx_msg_size() code will see old skb->len, most likely leading to an over-read. Worst case we will over read an entire record, next iteration will try to trim the skb but may end up turning frag len negative or discarding the subsequent record (since we already told TCP we've read it during previous read but now we'll trim it out of the skb). Fixes: 84c61fe1a75b ("tls: rx: do not use the standard strparser") Tested-by: Shai Amiram <samiram@nvidia.com> Signed-off-by: Jakub Kicinski <kuba@kernel.org> Reviewed-by: Simon Horman <simon.horman@corigine.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/tls')
-rw-r--r--net/tls/tls_strp.c21
1 files changed, 15 insertions, 6 deletions
diff --git a/net/tls/tls_strp.c b/net/tls/tls_strp.c
index 2b6fa9855999..e2e48217e7ac 100644
--- a/net/tls/tls_strp.c
+++ b/net/tls/tls_strp.c
@@ -210,19 +210,28 @@ static int tls_strp_copyin(read_descriptor_t *desc, struct sk_buff *in_skb,
skb_frag_size(frag),
chunk));
- sz = tls_rx_msg_size(strp, strp->anchor);
+ skb->len += chunk;
+ skb->data_len += chunk;
+ skb_frag_size_add(frag, chunk);
+
+ sz = tls_rx_msg_size(strp, skb);
if (sz < 0) {
desc->error = sz;
return 0;
}
/* We may have over-read, sz == 0 is guaranteed under-read */
- if (sz > 0)
- chunk = min_t(size_t, chunk, sz - skb->len);
+ if (unlikely(sz && sz < skb->len)) {
+ int over = skb->len - sz;
+
+ WARN_ON_ONCE(over > chunk);
+ skb->len -= over;
+ skb->data_len -= over;
+ skb_frag_size_add(frag, -over);
+
+ chunk -= over;
+ }
- skb->len += chunk;
- skb->data_len += chunk;
- skb_frag_size_add(frag, chunk);
frag++;
len -= chunk;
offset += chunk;