Patch "net: tls: fix marking packets as decrypted" has been added to the 6.9-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    net: tls: fix marking packets as decrypted

to the 6.9-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     net-tls-fix-marking-packets-as-decrypted.patch
and it can be found in the queue-6.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit cea48164b1cbef78c15fc1afd0bff2cd8184a496
Author: Jakub Kicinski <kuba@xxxxxxxxxx>
Date:   Thu May 30 16:26:07 2024 -0700

    net: tls: fix marking packets as decrypted
    
    [ Upstream commit a535d59432370343058755100ee75ab03c0e3f91 ]
    
    For TLS offload we mark packets with skb->decrypted to make sure
    they don't escape the host without getting encrypted first.
    The crypto state lives in the socket, so it may get detached
    by a call to skb_orphan(). As a safety check - the egress path
    drops all packets with skb->decrypted and no "crypto-safe" socket.
    
    The skb marking was added to sendpage only (and not sendmsg),
    because tls_device injected data into the TCP stack using sendpage.
    This special case was missed when sendpage got folded into sendmsg.
    
    Fixes: c5c37af6ecad ("tcp: Convert do_tcp_sendpages() to use MSG_SPLICE_PAGES")
    Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx>
    Reviewed-by: Eric Dumazet <edumazet@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/20240530232607.82686-1-kuba@xxxxxxxxxx
    Signed-off-by: Paolo Abeni <pabeni@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 66d77faca64f6..5c79836e4c9e7 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -1159,6 +1159,9 @@ int tcp_sendmsg_locked(struct sock *sk, struct msghdr *msg, size_t size)
 
 			process_backlog++;
 
+#ifdef CONFIG_SKB_DECRYPTED
+			skb->decrypted = !!(flags & MSG_SENDPAGE_DECRYPTED);
+#endif
 			tcp_skb_entail(sk, skb);
 			copy = size_goal;
 




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux