[PATCH net-next v4 1/9] tls: Bound consecutive no-data records in tls_sw_read_sock()

[Chuck Lever]

A zero-length application_data record does not deliver a payload, so
tls_sw_read_sock() never runs the read_actor for one and nothing
decrements desc->count. A peer that streams such records keeps the
loop running, with the socket lock held, for as long as they arrive.
The caller cannot bound the run because read_sock() has not
returned.

An LLM audit of the TLS read paths found this defect. The defect has
not been reproduced.

Stop after TLS_RX_NODATA_LIMIT consecutive empty data records. Any
record that delivers bytes resets the count. Stopping with nothing
copied returns zero, which a read_sock consumer takes as no progress
rather than EOF. A record parsed during the call but not yet
delivered is announced by tls_rx_reader_release(), so the consumer
is called again for that record.

Fixes: 3be28e2c9cd0 ("net/tls: Consume empty data records in 
tls_sw_read_sock()")
Signed-off-by: Chuck Lever <c...@kernel.org>
---
 net/tls/tls_sw.c | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
index 312e51270f29..a64244566af4 100644
--- a/net/tls/tls_sw.c
+++ b/net/tls/tls_sw.c
@@ -2070,6 +2070,8 @@ ssize_t tls_sw_splice_read(struct socket *sock,  loff_t 
*ppos,
        goto splice_read_end;
 }
 
+#define TLS_RX_NODATA_LIMIT    16
+
 int tls_sw_read_sock(struct sock *sk, read_descriptor_t *desc,
                     sk_read_actor_t read_actor)
 {
@@ -2078,6 +2080,7 @@ int tls_sw_read_sock(struct sock *sk, read_descriptor_t 
*desc,
        struct tls_prot_info *prot = &tls_ctx->prot_info;
        struct strp_msg *rxm = NULL;
        struct sk_buff *skb = NULL;
+       unsigned int nodata = 0;
        struct sk_psock *psock;
        size_t flushed_at = 0;
        bool released = true;
@@ -2136,14 +2139,19 @@ int tls_sw_read_sock(struct sock *sk, read_descriptor_t 
*desc,
                        goto read_sock_requeue;
                }
 
-               /* An empty data record (legal in TLS 1.3) gives a zero
-                * read_actor return, indistinguishable from the consumer
-                * stalling; the used <= 0 path would requeue it at the
-                * head of rx_list and block all later records. Consume it
-                * here instead.
+               /* An empty data record gives a zero read_actor return,
+                * indistinguishable from the consumer stalling; the
+                * used <= 0 path would requeue it at the head of rx_list
+                * and block all later records. Consume it here instead.
                 */
                if (rxm->full_len == 0) {
+                       err = 0;
                        consume_skb(skb);
+                       /* tls_rx_reader_release() announces a record left
+                        * parsed, so the consumer is called again for it.
+                        */
+                       if (++nodata >= TLS_RX_NODATA_LIMIT)
+                               break;
                        continue;
                }
 
@@ -2154,6 +2162,7 @@ int tls_sw_read_sock(struct sock *sk, read_descriptor_t 
*desc,
                        goto read_sock_requeue;
                }
                copied += used;
+               nodata = 0;
                if (used < rxm->full_len) {
                        rxm->offset += used;
                        rxm->full_len -= used;

-- 
2.55.0