An unprivileged local user can oops the kernel by splicing into a kTLS socket whose open record already has a full plaintext scatterlist ring.
sk_msg_page_add() has no fullness check of its own and tls_sw_sendmsg_splice() only tests sk_msg_full() at the bottom of its do-while loop, so a page is always added before the ring is checked. That first add writes the reserved slot and wraps sg.end onto sg.start; sk_msg_iter_dist() then returns 0, sk_msg_full() reports the full ring as empty, and the loop keeps overwriting live entries while sg.size grows. Pushing the resulting record drives the AEAD with a cryptlen larger than the walkable scatterlist, so the walk runs past the end-marked entry and dereferences the NULL returned by sg_next(). The ring is left full and unpushed across a syscall by the copy path, which does not set full_record when the fragment it adds is the one that exactly fills the ring. No capabilities, namespaces, io_uring, nftables or BPF are involved; a plain loopback TCP socket with the "tls" ULP attached is enough. Reproduced as an ordinary user (uid 1000) on stock production configs -- CONFIG_TLS=y, no KASAN, no LOCKDEP, no fault injection -- on 7.2.0-rc4 and on 6.12.96. Present since v6.5. Patch 1 evaluates the loop condition before the first sk_msg_page_add() instead of after it. Patch 2 adds a regression test: it oopses an unpatched kernel and passes with patch 1 applied (924/924 for the whole tls suite, with CONFIG_CRYPTO_CHACHA20POLY1305, CONFIG_CRYPTO_SM4 and CONFIG_CRYPTO_ARIA enabled so every cipher variant runs). I found this with AI assistance, so per Documentation/process/security-bugs.rst I am treating it as public and posting here rather than sending it to [email protected]. For the same reason I am not posting the standalone reproducer; I can send it privately if that would be useful. chanyoung (2): tls: don't over-fill the plaintext sk_msg ring in tls_sw_sendmsg_splice() selftests: tls: add a test for splicing onto a full plaintext record net/tls/tls_sw.c | 4 +-- tools/testing/selftests/net/tls.c | 52 +++++++++++++++++++++++++++++++ 2 files changed, 54 insertions(+), 2 deletions(-) -- 2.43.0
