linux-stable.git/net/tls, branch v5.13.2

tls: prevent oversized sendfile() hangs by ignoring MSG_MORE

2021-07-14T15:07:13+00:00

[ Upstream commit d452d48b9f8b1a7f8152d33ef52cfd7fe1735b0a ]

We got multiple reports that multi_chunk_sendfile test
case from tls selftest fails. This was sort of expected,
as the original fix was never applied (see it in the first
Link:). The test in question uses sendfile() with count
larger than the size of the underlying file. This will
make splice set MSG_MORE on all sendpage calls, meaning
TLS will never close and flush the last partial record.

Eric seem to have addressed a similar problem in
commit 35f9c09fe9c7 ("tcp: tcp_sendpages() should call tcp_push() once")
by introducing MSG_SENDPAGE_NOTLAST. Unlike MSG_MORE
MSG_SENDPAGE_NOTLAST is not set on the last call
of a "pipefull" of data (PIPE_DEF_BUFFERS == 16,
so every 16 pages or whenever we run out of data).

Having a break every 16 pages should be fine, TLS
can pack exactly 4 pages into a record, so for
aligned reads there should be no difference,
unaligned may see one extra record per sendpage().

Sticking to TCP semantics seems preferable to modifying
splice, but we can revisit it if real life scenarios
show a regression.

Reported-by: Vadim Fedorenko 
Reported-by: Seth Forshee 
Link: https://lore.kernel.org/netdev/1591392508-14592-1-git-send-email-pooja.trivedi@stackpath.com/
Fixes: 3c4d7559159b ("tls: kernel TLS support")
Signed-off-by: Jakub Kicinski 
Tested-by: Seth Forshee 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin

net/tls: Fix use-after-free after the TLS device goes down and up

2021-06-01T22:58:05+00:00

When a netdev with active TLS offload goes down, tls_device_down is
called to stop the offload and tear down the TLS context. However, the
socket stays alive, and it still points to the TLS context, which is now
deallocated. If a netdev goes up, while the connection is still active,
and the data flow resumes after a number of TCP retransmissions, it will
lead to a use-after-free of the TLS context.

This commit addresses this bug by keeping the context alive until its
normal destruction, and implements the necessary fallbacks, so that the
connection can resume in software (non-offloaded) kTLS mode.

On the TX side tls_sw_fallback is used to encrypt all packets. The RX
side already has all the necessary fallbacks, because receiving
non-decrypted packets is supported. The thing needed on the RX side is
to block resync requests, which are normally produced after receiving
non-decrypted packets.

The necessary synchronization is implemented for a graceful teardown:
first the fallbacks are deployed, then the driver resources are released
(it used to be possible to have a tls_dev_resync after tls_dev_del).

A new flag called TLS_RX_DEV_DEGRADED is added to indicate the fallback
mode. It's used to skip the RX resync logic completely, as it becomes
useless, and some objects may be released (for example, resync_async,
which is allocated and freed by the driver).

Fixes: e8f69799810c ("net/tls: Add generic NIC offload infrastructure")
Signed-off-by: Maxim Mikityanskiy 
Reviewed-by: Tariq Toukan 
Signed-off-by: David S. Miller

net/tls: Replace TLS_RX_SYNC_RUNNING with RCU

2021-06-01T22:58:05+00:00

RCU synchronization is guaranteed to finish in finite time, unlike a
busy loop that polls a flag. This patch is a preparation for the bugfix
in the next patch, where the same synchronize_net() call will also be
used to sync with the TX datapath.

Signed-off-by: Maxim Mikityanskiy 
Reviewed-by: Tariq Toukan 
Signed-off-by: David S. Miller

tls splice: check SPLICE_F_NONBLOCK instead of MSG_DONTWAIT

2021-05-14T22:03:25+00:00

In tls_sw_splice_read, checkout MSG_* is inappropriate, should use
SPLICE_*, update tls_wait_data to accept nonblock arguments instead
of flags for recvmsg and splice.

Fixes: c46234ebb4d1 ("tls: RX path for ktls")
Signed-off-by: Jim Ma 
Signed-off-by: David S. Miller

net/tls: Remove redundant initialization of record

2021-04-27T21:15:19+00:00

record is being initialized to ctx->open_record but this is never
read as record is overwritten later on.  Remove the redundant
initialization.

Cleans up the following clang-analyzer warning:

net/tls/tls_device.c:421:26: warning: Value stored to 'record' during
its initialization is never read [clang-analyzer-deadcode.DeadStores].

Reported-by: Abaci Robot 
Signed-off-by: Jiapeng Chong 
Signed-off-by: David S. Miller

skmsg: Extract __tcp_bpf_recvmsg() and tcp_bpf_wait_data()

2021-04-01T17:56:14+00:00

Although these two functions are only used by TCP, they are not
specific to TCP at all, both operate on skmsg and ingress_msg,
so fit in net/core/skmsg.c very well.

And we will need them for non-TCP, so rename and move them to
skmsg.c and export them to modules.

Signed-off-by: Cong Wang 
Signed-off-by: Alexei Starovoitov 
Link: https://lore.kernel.org/bpf/20210331023237.41094-13-xiyou.wangcong@gmail.com

net/tls: Fix a typo in tls_device.c

2021-03-25T00:52:11+00:00

s/beggining/beginning/

Reported-by: Hulk Robot 
Signed-off-by: Wang Hai 
Acked-by: Randy Dunlap 
Signed-off-by: David S. Miller

net/tls: Select SOCK_RX_QUEUE_MAPPING from TLS_DEVICE

2021-02-12T03:08:06+00:00

Compile-in the socket RX queue mapping field and logic when TLS_DEVICE
is enabled. This allows device drivers to pick the recorded socket's
RX queue and use it for streams distribution.

Signed-off-by: Tariq Toukan 
Reviewed-by: Maxim Mikityanskiy 
Signed-off-by: David S. Miller

net/tls: Except bond interface from some TLS checks

2021-01-19T04:48:40+00:00

In the tls_dev_event handler, ignore tlsdev_ops requirement for bond
interfaces, they do not exist as the interaction is done directly with
the lower device.

Also, make the validate function pass when it's called with the upper
bond interface.

Signed-off-by: Tariq Toukan 
Reviewed-by: Boris Pismenny 
Signed-off-by: Jakub Kicinski

net/tls: Device offload to use lowest netdevice in chain

2021-01-19T04:48:40+00:00

Do not call the tls_dev_ops of upper devices. Instead, ask them
for the proper lowest device and communicate with it directly.

Signed-off-by: Tariq Toukan 
Reviewed-by: Boris Pismenny 
Signed-off-by: Jakub Kicinski