On Mon, Oct 26, 2026, at 6:37 PM, Jakub Kicinski wrote:
> On Mon, 19 Oct 2026 12:55:16 -0400 Chuck Lever wrote:
>> Commit 3be28e2c9cd0 ("net/tls: Consume empty data records in
>> tls_sw_read_sock()") fixed one reader. TLS 1.2 and TLS 1.3 both
>> permit a zero-length application_data record as a traffic-analysis
>> countermeasure (RFC 5246, Section 6.2.1; RFC 8446, Section 5.1), so
>> a peer that pads its stream emits them by design. The other two
>> software readers still mishandle them. splice(2) reports an empty
>> record as EOF, and the caller tears down a connection that is still
>> live. recvmsg(2) makes no progress on one, so a peer that streams
>> them holds the caller in the kernel past SIGKILL. With MSG_PEEK or
>> async decryption, each record is also queued on rx_list, which
>> grows without bound.
>
> The shape of this series is still quite confusing to me.
> Let me take over a little bit so that we make some progress
> (while retaining your authorship where possible).
Fair enough, thanks! The first 2 patches look fine to me.
I'm not sure whether I need to add an Ack -- they already
carry my SoB.
--
Chuck Lever (Come to NFS bake-a-thon! https://nfsv4bat.org)
