tree fe3c6a08ec7e60eb9704a3acf61124a9d5c85986
parent 3f210da309023fecbb54e0b87a193714c72b8077
author Jakub Kicinski <kuba@kernel.org> 1707268701 -0800
committer COS Cherry Picker <cloud-image-release@prod.google.com> 1711388371 -0700

net: tls: handle backlogging of crypto requests

[ Upstream commit 8590541473188741055d27b955db0777569438e3 ]

Since we're setting the CRYPTO_TFM_REQ_MAY_BACKLOG flag on our
requests to the crypto API, crypto_aead_{encrypt,decrypt} can return
 -EBUSY instead of -EINPROGRESS in valid situations. For example, when
the cryptd queue for AESNI is full (easy to trigger with an
artificially low cryptd.cryptd_max_cpu_qlen), requests will be enqueued
to the backlog but still processed. In that case, the async callback
will also be called twice: first with err == -EINPROGRESS, which it
seems we can just ignore, then with err == 0.

Compared to Sabrina's original patch this version uses the new
tls_*crypt_async_wait() helpers and converts the EBUSY to
EINPROGRESS to avoid having to modify all the error handling
paths. The handling is identical.

BUG=b/326485556
TEST=presubmit
RELEASE_NOTE=Fixed CVE-2024-26584 in the Linux kernel.

cos-patch: security-high
Fixes: a54667f6728c ("tls: Add support for encryption using async offload accelerator")
Fixes: 94524d8fc965 ("net/tls: Add support for async decryption of tls records")
Co-developed-by: Sabrina Dubroca <sd@queasysnail.net>
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Link: https://lore.kernel.org/netdev/9681d1febfec295449a62300938ed2ae66983f28.1694018970.git.sd@queasysnail.net/
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 13eca403876bbea3716e82cdfe6f1e6febb38754)
Signed-off-by: Robert Kolchmeyer <rkolchmeyer@google.com>
Change-Id: Icc1d39df83e746a7e6cd4aec4bd02854612355dc
Reviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/67110
Reviewed-by: Oleksandr Tymoshenko <ovt@google.com>
Main-Branch-Verified: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>
Tested-by: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>