net/tls: take into account that bpf_exec_tx_verdict() may free the record

[ Upstream commit c329ef9684de9517d82af5b4758c9e1b64a8a11a ]

bpf_exec_tx_verdict() may free the record if tls_push_record()
fails, or if the entire record got consumed by BPF. Re-check
ctx->open_rec before touching the data.

Fixes: d3b18ad31f93 ("tls: add bpf support to sk_msg handling")
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Reviewed-by: Simon Horman <simon.horman@netronome.com>
Acked-by: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
index 319735d5c084f7428a0107d65a60489df1061894..cf715e12480503ba57c29b2fba2849974945b0d8 100644 (file)
--- a/net/tls/tls_sw.c
+++ b/net/tls/tls_sw.c
@@ -979,7 +979,7 @@ alloc_encrypted:
                                        num_async++;
                                else if (ret == -ENOMEM)
                                        goto wait_for_memory;
-                               else if (ret == -ENOSPC)
+                               else if (ctx->open_rec && ret == -ENOSPC)
                                        goto rollback_iter;
                                else if (ret != -EAGAIN)
                                        goto send_end;
@@ -1048,11 +1048,12 @@ wait_for_memory:
                ret = sk_stream_wait_memory(sk, &timeo);
                if (ret) {
 trim_sgl:
-                       tls_trim_both_msgs(sk, orig_size);
+                       if (ctx->open_rec)
+                               tls_trim_both_msgs(sk, orig_size);
                        goto send_end;
                }
 
-               if (msg_en->sg.size < required_size)
+               if (ctx->open_rec && msg_en->sg.size < required_size)
                        goto alloc_encrypted;
        }
 
@@ -1185,11 +1186,13 @@ wait_for_sndbuf:
 wait_for_memory:
                ret = sk_stream_wait_memory(sk, &timeo);
                if (ret) {
-                       tls_trim_both_msgs(sk, msg_pl->sg.size);
+                       if (ctx->open_rec)
+                               tls_trim_both_msgs(sk, msg_pl->sg.size);
                        goto sendpage_end;
                }
 
-               goto alloc_payload;
+               if (ctx->open_rec)
+                       goto alloc_payload;
        }
 
        if (num_async) {