tls: rx: restore msg_iter before TLS 1.3 optimistic retry

tls_decrypt_sg() advances msg->msg_iter when it maps user pages for
the optimistic TLS 1.3 zero-copy path. If the decrypted record turns
out not to be unpadded application data, tls_decrypt_sw() retries into
a kernel skb, but leaves the iterator advanced.

The subsequent copy from the skb then writes decrypted bytes again at
a later point in the caller iovecs while recvmsg() reports only the
post-retry length. A TLS peer can trigger this after the receiver
enables TLS_RX_EXPECT_NO_PAD.

Revert the iterator by the number of bytes consumed by the optimistic
mapping before retrying without zero-copy.

Add a selftest which sends a TLS 1.3 control record with
TLS_RX_EXPECT_NO_PAD enabled and verifies that recvmsg() does not
overwrite later iovecs beyond the returned length.

Fixes: ce61327ce989 ("tls: rx: support optimistic decrypt to user buffer with TLS 1.3")
Cc: stable@vger.kernel.org
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
Link: https://patch.msgid.link/20260804125528.2139928-1-Jeremy.Jean@oss.cyber.gouv.fr
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
index d2e399be8ef6e0533ef2d3054e6fdaf4af792fb6..133ed7c8940284510f2dc571ffd13eaf5dcba4db 100644 (file)
--- a/net/tls/tls_sw.c
+++ b/net/tls/tls_sw.c
@@ -1456,6 +1456,8 @@ tls_decrypt_sw(struct sock *sk, struct tls_context *tls_ctx,
        /* If opportunistic TLS 1.3 ZC failed retry without ZC */
        if (unlikely(darg->zc && prot->version == TLS_1_3_VERSION &&
                     darg->tail != TLS_RECORD_TYPE_DATA)) {
+               iov_iter_revert(&msg->msg_iter, strp_msg(darg->skb)->full_len -
+                               prot->overhead_size);
                darg->zc = false;
                if (!darg->tail)
                        TLS_INC_STATS(sock_net(sk), LINUX_MIB_TLSRXNOPADVIOL);

diff --git a/tools/testing/selftests/net/tls.c b/tools/testing/selftests/net/tls.c
index 3d6f553eaf973d86c1b05200ae8c9aa5bc7d677b..a0e72e402748fe6f240c0d1a4edcc7848e2d6fb2 100644 (file)
--- a/tools/testing/selftests/net/tls.c
+++ b/tools/testing/selftests/net/tls.c
@@ -1839,6 +1839,63 @@ TEST_F(tls, recv_efault)
 }
 
 #define TLS_RECORD_TYPE_HANDSHAKE      0x16
+
+TEST_F(tls_basic, recvmsg_nopad_retry_iov)
+{
+       char payload[32];
+       char first_iov[sizeof(payload)];
+       char later_iov[sizeof(payload) * 2];
+       char expected_later_iov[sizeof(later_iov)];
+       char cbuf[CMSG_SPACE(sizeof(char))];
+       struct tls_crypto_info_keys tls13;
+       struct iovec iov[] = {
+               { .iov_base = first_iov, .iov_len = sizeof(first_iov) },
+               { .iov_base = later_iov, .iov_len = sizeof(later_iov) },
+       };
+       struct msghdr msg = {
+               .msg_iov = iov,
+               .msg_iovlen = ARRAY_SIZE(iov),
+               .msg_control = cbuf,
+               .msg_controllen = sizeof(cbuf),
+       };
+       int one = 1;
+       int ret;
+       int i;
+
+       if (self->notls)
+               SKIP(return, "no TLS support");
+
+       tls_crypto_info_init(TLS_1_3_VERSION, TLS_CIPHER_AES_GCM_128,
+                            &tls13, 0);
+
+       ret = setsockopt(self->fd, SOL_TLS, TLS_TX, &tls13, tls13.len);
+       ASSERT_EQ(ret, 0);
+
+       ret = setsockopt(self->cfd, SOL_TLS, TLS_RX, &tls13, tls13.len);
+       ASSERT_EQ(ret, 0);
+
+       ret = setsockopt(self->cfd, SOL_TLS, TLS_RX_EXPECT_NO_PAD,
+                        &one, sizeof(one));
+       ASSERT_EQ(ret, 0);
+
+       for (i = 0; i < sizeof(payload); i++)
+               payload[i] = 0x40 + i;
+       memset(first_iov, 0xa5, sizeof(first_iov));
+       memset(later_iov, 0x5a, sizeof(later_iov));
+       memset(expected_later_iov, 0x5a, sizeof(expected_later_iov));
+
+       /* A control record forces optimistic TLS 1.3 RX to retry. */
+       ret = tls_send_cmsg(self->fd, TLS_RECORD_TYPE_HANDSHAKE,
+                           payload, sizeof(payload), 0);
+       ASSERT_EQ(ret, sizeof(payload));
+
+       ret = recvmsg(self->cfd, &msg, 0);
+       ASSERT_EQ(ret, sizeof(payload));
+       EXPECT_EQ(memcmp(first_iov, payload, sizeof(payload)), 0);
+       EXPECT_EQ(memcmp(later_iov, expected_later_iov,
+                        sizeof(later_iov)), 0);
+}
+
 /* key_update, length 1, update_not_requested */
 static const char key_update_msg[] = "\x18\x00\x00\x01\x00";
 static void tls_send_keyupdate(struct __test_metadata *_metadata, int fd)