An empty TLS 1.3 data record delivers no payload, so it leaves
tls_sw_read_sock() in its loop without advancing the caller's read
descriptor. A peer that streams such records keeps the receive loop
running, and the socket lock held, for as long as they arrive.
Bound a run of such records, as net_rx_action() bounds a softirq
poll. The first record that delivers no bytes arms a deadline
TLS_RX_NODATA_NS ahead; any record that delivers bytes disarms it,
so a normal stream never trips it. Breaking out with nothing copied
returns zero, which a read_sock consumer reads as "no progress"
rather than EOF, so the connection stays up. Records left queued
draw no fresh sk_data_ready() of their own, so fire the socket's
current callback before returning.
Only tls_sw_read_sock() needs this bound. Its consumers drive the
receive loop from kernel context and hold the socket lock across
the whole call, so the deadline supplies the return boundary a
system call would otherwise provide. tls_sw_splice_read() and
tls_sw_recvmsg() return to userspace and drop the lock, so a flood
there costs the caller only its own scheduler time.
Fixes: 3be28e2c9cd0 ("net/tls: Consume empty data records in
tls_sw_read_sock()")
Suggested-by: Sabrina Dubroca <[email protected]>
Signed-off-by: Chuck Lever <[email protected]>
---
net/tls/tls_sw.c | 20 ++++++++++++++++++++
1 file changed, 20 insertions(+)
diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
index d4afc90fd796..d45c945a3d1d 100644
--- a/net/tls/tls_sw.c
+++ b/net/tls/tls_sw.c
@@ -37,6 +37,7 @@
#include <linux/bug.h>
#include <linux/sched/signal.h>
+#include <linux/timekeeping.h>
#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/splice.h>
@@ -2049,6 +2050,11 @@ ssize_t tls_sw_splice_read(struct socket *sock, loff_t
*ppos,
goto splice_read_end;
}
+/* Bound the time that consecutive empty ingress data records keep
+ * the socket lock held without releasing it.
+ */
+#define TLS_RX_NODATA_NS NSEC_PER_MSEC
+
int tls_sw_read_sock(struct sock *sk, read_descriptor_t *desc,
sk_read_actor_t read_actor)
{
@@ -2057,6 +2063,7 @@ int tls_sw_read_sock(struct sock *sk, read_descriptor_t
*desc,
struct tls_prot_info *prot = &tls_ctx->prot_info;
struct strp_msg *rxm = NULL;
struct sk_buff *skb = NULL;
+ u64 nodata_deadline = 0;
struct sk_psock *psock;
size_t flushed_at = 0;
bool released = true;
@@ -2122,7 +2129,19 @@ int tls_sw_read_sock(struct sock *sk, read_descriptor_t
*desc,
* here instead.
*/
if (rxm->full_len == 0) {
+ err = 0;
consume_skb(skb);
+ if (!nodata_deadline) {
+ nodata_deadline = ktime_get_ns() +
+ TLS_RX_NODATA_NS;
+ } else if (ktime_get_ns() >= nodata_deadline) {
+ /* Queued records raise no new sk_data_ready(),
+ * and tls_rx_reader_release() announces only to
+ * saved_data_ready(), not the consumer's own.
+ */
+ sk->sk_data_ready(sk);
+ break;
+ }
continue;
}
@@ -2133,6 +2152,7 @@ int tls_sw_read_sock(struct sock *sk, read_descriptor_t
*desc,
goto read_sock_requeue;
}
copied += used;
+ nodata_deadline = 0;
if (used < rxm->full_len) {
rxm->offset += used;
rxm->full_len -= used;
--
2.54.0
