tls_rx_rec_wait() tests signal_pending() only after it sleeps, and
it skips the wait loop when a record is already parsed.
tls_sw_recvmsg() calls it once per record, and a zero-length
application_data record advances neither of its loop bounds. A
peer that streams such records holds the caller in recvmsg(),
unresponsive to SIGKILL, for as long as they arrive.
Test for a pending signal in tls_sw_recvmsg() before it fetches the
record after an empty one. A reader that has copied data returns
it, and a nonblocking reader gets -EINTR. The test stays out of
tls_rx_rec_wait() because tls_sw_read_sock() also calls it, from
callers that cannot act on a signal.
Fixes: c46234ebb4d1 ("tls: RX path for ktls")
Signed-off-by: Chuck Lever <[email protected]>
---
net/tls/tls_sw.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
index c78471c53f2f..ee50b9028264 100644
--- a/net/tls/tls_sw.c
+++ b/net/tls/tls_sw.c
@@ -1824,6 +1824,7 @@ int tls_sw_recvmsg(struct sock *sk,
bool is_peek = flags & MSG_PEEK;
bool rx_more = false;
bool released = true;
+ bool nodata = false;
bool zc_capable;
if (unlikely(flags & MSG_ERRQUEUE))
@@ -1858,6 +1859,16 @@ int tls_sw_recvmsg(struct sock *sk,
struct tls_decrypt_arg darg;
int to_decrypt, chunk;
+ /* A run of empty records advances neither loop bound, and
+ * tls_rx_rec_wait() tests for a signal only after it sleeps.
+ */
+ if (nodata && signal_pending(current)) {
+ long timeo = sock_rcvtimeo(sk, flags & MSG_DONTWAIT);
+
+ err = sock_intr_errno(timeo);
+ goto recv_end;
+ }
+
err = tls_rx_rec_wait(sk, flags & MSG_DONTWAIT,
released, !!(decrypted + copied));
if (err <= 0)
@@ -1910,6 +1921,7 @@ int tls_sw_recvmsg(struct sock *sk,
/* TLS 1.3 may have updated the length by more than overhead */
rxm = strp_msg(darg.skb);
chunk = rxm->full_len;
+ nodata = !chunk;
tls_rx_rec_done(ctx);
if (!darg.zc) {
--
2.55.0
