Hi Jakub, On 2026/4/30 6:29, Jakub Kicinski wrote:
tls_sw_splice_read() uses len when advancing rxm->offset / rxm->full_len after skb_splice_bits(), rather than copied (the actual number of bytes successfully spliced into the pipe). When the destination pipe cannot accept all the requested bytes, splice_to_pipe() returns fewer bytes than len, and 'len - copied' of data is effectively skipped over.Fixes: e062fe99cccd ("tls: splice_read: fix accessing pre-processed records") Signed-off-by: Jakub Kicinski <[email protected]> --- CC: [email protected] CC: [email protected] --- net/tls/tls_sw.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
I just hit this bug on v6.18.y. Somehow this was not automatically backported to stable?
+Cc: stable Best regards, Qingfang
