Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8ab6ffba authored by Matt Mullins's avatar Matt Mullins Committed by David S. Miller
Browse files

tls: don't use stack memory in a scatterlist 



scatterlist code expects virt_to_page() to work, which fails with
CONFIG_VMAP_STACK=y.

Fixes: c46234eb ("tls: RX path for ktls")
Signed-off-by: default avatarMatt Mullins <mmullins@fb.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 7063efd3

include/net/tls.h

+3 −0
Original line number Diff line number Diff line
@@ -97,6 +97,9 @@ struct tls_sw_context { 
	u8 control;

	bool decrypted;



	char rx_aad_ciphertext[TLS_AAD_SPACE_SIZE];

	char rx_aad_plaintext[TLS_AAD_SPACE_SIZE];



	/* Sending context */

	char aad_space[TLS_AAD_SPACE_SIZE];

net/tls/tls_sw.c

+4 −5
Original line number Diff line number Diff line
@@ -680,7 +680,6 @@ static int decrypt_skb(struct sock *sk, struct sk_buff *skb, 
	struct scatterlist *sgin = &sgin_arr[0];

	struct strp_msg *rxm = strp_msg(skb);

	int ret, nsg = ARRAY_SIZE(sgin_arr);

	char aad_recv[TLS_AAD_SPACE_SIZE];

	struct sk_buff *unused;



	ret = skb_copy_bits(skb, rxm->offset + TLS_HEADER_SIZE,
@@ -698,13 +697,13 @@ static int decrypt_skb(struct sock *sk, struct sk_buff *skb, 
	}



	sg_init_table(sgin, nsg);

	sg_set_buf(&sgin[0], aad_recv, sizeof(aad_recv));

	sg_set_buf(&sgin[0], ctx->rx_aad_ciphertext, TLS_AAD_SPACE_SIZE);



	nsg = skb_to_sgvec(skb, &sgin[1],

			   rxm->offset + tls_ctx->rx.prepend_size,

			   rxm->full_len - tls_ctx->rx.prepend_size);



	tls_make_aad(aad_recv,

	tls_make_aad(ctx->rx_aad_ciphertext,

		     rxm->full_len - tls_ctx->rx.overhead_size,

		     tls_ctx->rx.rec_seq,

		     tls_ctx->rx.rec_seq_size,
@@ -803,12 +802,12 @@ int tls_sw_recvmsg(struct sock *sk, 
			if (to_copy <= len && page_count < MAX_SKB_FRAGS &&

			    likely(!(flags & MSG_PEEK)))  {

				struct scatterlist sgin[MAX_SKB_FRAGS + 1];

				char unused[21];

				int pages = 0;



				zc = true;

				sg_init_table(sgin, MAX_SKB_FRAGS + 1);

				sg_set_buf(&sgin[0], unused, 13);

				sg_set_buf(&sgin[0], ctx->rx_aad_plaintext,

					   TLS_AAD_SPACE_SIZE);



				err = zerocopy_from_iter(sk, &msg->msg_iter,

							 to_copy, &pages,