[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [PATCH net-next 14/15] net/tls: don't BUG() on leftover length in __skb_nsg()
- To: Josef Bacik <josef@xxxxxxxxxxxxxx>
- From: Mina Almasry <almasrymina@xxxxxxxxxx>
- Date: Mon, 19 Oct 2026 08:12:53 -0700
- Arc-authentication-results: i=1; mx.google.com; arc=none
- Arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:dkim-signature; bh=/p9kG3mVIwDhglO8V3Ucme+ROyhYkCFN2qn2+pS+V4w=; fh=zXfrAGZcPAH1H+H6X6WdpvYLADKlg3K8IW6L8vxQKSk=; b=ia6rHut/lA6t0/AAFvXFRG9rTcd+nAa1rdzNoDs3Y2Mym0E8hMI2nswgwChq54E6ka 8AZZecm3aKNM2mpZTrb5FHHBR1152NC+2oCJ0cbelkBwMVuO+xW4aWcq5ZdVkqHCkgCt cdrO1e+BvRMtVQbhqwLL5lfqp+IbfGyFJSTwk7YCMENiAOegkN62BMIn5i+L+Chsw0ZZ aYeVATVMrBiTIN4NboOWlJ1iFKSwfPmwKTbmE+sU2pJs1KcTYUvySZU6trl3rX9GQZks t88xWj6MVEyrQ0T+R6qvWNq1v8M3nL3DzwW+yDFuXugeyeI5bJNNXNtIi1iE3aGoL+eH I5eg==; darn=lists.xenproject.org
- Arc-seal: i=1; a=rsa-sha256; t=1792422786; cv=none; d=google.com; s=arc-20260327; b=oD0+etEaXy/sl5TrFDPZIG/8u1LWOq6l8ZLg6+yvGc8dSk2i/jhfPsc/cxT9NfZgVJ c7tFRPDtvq4Acq1/bvTUR0LqNQhZPg98dPW5I9urvjsLhX/tpdpeND3e8zzpjbywavZr jGDuDr0jXM/VL46dNly9tQpHZfvQW5xxfUrNJUOp4ePKfw+Z4/dsXJ12QbnVzwHYMgoW gY1w6tumQcW/ljUxMrGj+IdvOLkIUIinh8WyCQlzKFbnuJToZvNH3Vvn4IGey4/IsHLo 5GO5u4+CDfXqHDGIKfdY9XJjNDGqg0yzu6LyJ1EeyyXXfIKKQAGhpLQz4JlIuOJbLk85 SCNA==
- Authentication-results: eu.smtp.expurgate.cloud; dkim=pass header.s=20251104 header.d=google.com header.i="@google.com" header.h="Content-Transfer-Encoding:Content-Type:Cc:To:Subject:Message-ID:Date:From:In-Reply-To:References:MIME-Version"
- Cc: "David S. Miller" <davem@xxxxxxxxxxxxx>, Eric Dumazet <edumazet@xxxxxxxxxx>, Jakub Kicinski <kuba@xxxxxxxxxx>, Paolo Abeni <pabeni@xxxxxxxxxx>, Simon Horman <horms@xxxxxxxxxx>, Andrew Lunn <andrew+netdev@xxxxxxx>, Juergen Gross <jgross@xxxxxxxx>, Stefano Stabellini <sstabellini@xxxxxxxxxx>, Willem de Bruijn <willemdebruijn.kernel@xxxxxxxxx>, Fernando Fernandez Mancera <fmancera@xxxxxxx>, David Laight <david.laight.linux@xxxxxxxxx>, netdev@xxxxxxxxxxxxxxx, xen-devel@xxxxxxxxxxxxxxxxxxxx
- Delivery-date: Mon, 19 Oct 2026 16:05:42 +0000
- List-id: Xen developer discussion <xen-devel.lists.xenproject.org>
On Mon, Oct 19, 2026 at 6:51 AM Josef Bacik <josef@xxxxxxxxxxxxxx> wrote:
>
> __skb_nsg() counts the scatterlist entries for a range of an skb with a
> copy of the __skb_to_sgvec() walk, including its BUG_ON(len) when the
> skb runs out before the range does. tls_decrypt_sg() calls it on the
> same range it then passes to skb_to_sgvec(), so a bad range would BUG()
> here before it got to skb_to_sgvec()'s error return.
>
> __skb_nsg() already returns -EMSGSIZE for a frag_list nested too deep,
> and tls_decrypt_sg() fails the record on any return below 1. Return
> -EINVAL for the leftover length too, with a DEBUG_NET_WARN_ON_ONCE() for
> debug kernels.
>
> Assisted-by: LLM
> Signed-off-by: Josef Bacik <josef@xxxxxxxxxxxxxx>
> ---
> net/tls/tls_sw.c | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
> index 312e51270f29..1c578ea47a1b 100644
> --- a/net/tls/tls_sw.c
> +++ b/net/tls/tls_sw.c
> @@ -142,7 +142,10 @@ static int __skb_nsg(struct sk_buff *skb, int offset,
> int len,
> start = end;
> }
> }
> - BUG_ON(len);
> + if (unlikely(len)) {
> + DEBUG_NET_WARN_ON_ONCE(1);
> + return -EINVAL;
> + }
Ugh, why DEBUG_NET_WARN...? Seems WARN_ON_ONCE() is more appropriate,
after all we're downgrading from a BUG_ON(). Another nice thing is
that it could have been done inline:
if (unlikely(WARN_ON_ONCE(len)))
return -EINVAL;
But I suppose it doesn't matter much
Acked-by: Mina Almasry <almasrymina@xxxxxxxxxx>
--
Thanks,
Mina
|
