linux-kernel - Re: [PATCH] tls: defer close to kernel task

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 10 Apr 2024 06:11:28 -0700
From: Jakub Kicinski <kuba@...nel.org>
To: Sascha Hauer <s.hauer@...gutronix.de>
Cc: Boris Pismenny <borisp@...dia.com>, John Fastabend
 <john.fastabend@...il.com>, "David S. Miller" <davem@...emloft.net>, Eric
 Dumazet <edumazet@...gle.com>, Paolo Abeni <pabeni@...hat.com>,
 netdev@...r.kernel.org, linux-kernel@...r.kernel.org, Pavel Begunkov
 <asml.silence@...il.com>, Jens Axboe <axboe@...nel.dk>,
 kernel@...gutronix.de
Subject: Re: [PATCH] tls: defer close to kernel task

On Wed, 10 Apr 2024 08:33:07 +0200 Sascha Hauer wrote:
> proto->close is normally called from a userspace task which can be
> interrupted by signals. When asynchronous encryption is used then KTLS
> sends out the final data at close time. When a signal comes in during
> close then it can happen tcp_sendmsg_locked() is interrupted by that
> signal while waiting for memory in sk_stream_wait_memory() which then
> returns with -ERSTARTSYS. It is not possible to recover from this situation
> and the final transmit data is lost.
> 
> With this patch we defer the close operation to a kernel task which
> doesn't get signals.
> 
> The described situation happens when KTLS is used in conjunction with
> io_uring, as io_uring uses task_work_add() to add work to the current
> userspace task.
> 
> The problem is discussed in [1] and [2] and the solution implemented in
> this patch is suggested by Pavel Begunkov here [3]

Appears to crash reliably.
Please run the tls selftests with KASAN enabled.
-- 
pw-bot: cr