)]}'
{
  "commit": "38b7911a3e469f3db4aeeb6e29daae6617e47384",
  "tree": "6666ea2c6ca9d5d637e5897ab831ebcc251613e8",
  "parents": [
    "72b1581e3e864e1191f3e8f00be19adaa35dc958"
  ],
  "author": {
    "name": "Jakub Kicinski",
    "email": "kuba@kernel.org",
    "time": "Tue Sep 16 17:28:13 2025 -0700"
  },
  "committer": {
    "name": "Cloud Image Release",
    "email": "cloud-image-release@prod.google.com",
    "time": "Fri Sep 26 15:33:23 2025 -0700"
  },
  "message": "tls: make sure to abort the stream if headers are bogus\n\nNormally we wait for the socket to buffer up the whole record\nbefore we service it. If the socket has a tiny buffer, however,\nwe read out the data sooner, to prevent connection stalls.\nMake sure that we abort the connection when we find out late\nthat the record is actually invalid. Retrying the parsing is\nfine in itself but since we copy some more data each time\nbefore we parse we can overflow the allocated skb space.\n\nConstructing a scenario in which we\u0027re under pressure without\nenough data in the socket to parse the length upfront is quite\nhard. syzbot figured out a way to do this by serving us the header\nin small OOB sends, and then filling in the recvbuf with a large\nnormal send.\n\nMake sure that tls_rx_msg_size() aborts strp, if we reach\nan invalid record there\u0027s really no way to recover.\n\nReported-by: Lee Jones \u003clee@kernel.org\u003e\nFixes: 84c61fe1a75b (\"tls: rx: do not use the standard strparser\")\nReviewed-by: Sabrina Dubroca \u003csd@queasysnail.net\u003e\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nLink: https://patch.msgid.link/20250917002814.1743558-1-kuba@kernel.org\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n\nBUG\u003db/446654965\nTEST\u003dpresubmit\nRELEASE_NOTE\u003dFixed KCTF-0aeb54a in the Linux Kernel.\n\ncos-patch: security-high\nChange-Id: Ifac6bfd9c784829643c2ffa674aa07c09c73e53e\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/111963\nReviewed-by: Kevin Berry \u003ckpberry@google.com\u003e\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\nMain-Branch-Verified: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/112383\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "5dc61c85c076ec4073c09c4c1e01dd1051a5d16c",
      "old_mode": 33188,
      "old_path": "net/tls/tls.h",
      "new_id": "a3c5c5a59fda69e634ed6849d91d2344454f43a1",
      "new_mode": 33188,
      "new_path": "net/tls/tls.h"
    },
    {
      "type": "modify",
      "old_id": "6ce64a6e4495ece52aa9cfc1386856cad4fb68bb",
      "old_mode": 33188,
      "old_path": "net/tls/tls_strp.c",
      "new_id": "ae723cd6af3975c17831ee9679ffafb826cedaf5",
      "new_mode": 33188,
      "new_path": "net/tls/tls_strp.c"
    },
    {
      "type": "modify",
      "old_id": "27ce1feb79e14e494f5efa582874259d521369f8",
      "old_mode": 33188,
      "old_path": "net/tls/tls_sw.c",
      "new_id": "435235a351e2f4053872a1f1626d1f0e49b5a437",
      "new_mode": 33188,
      "new_path": "net/tls/tls_sw.c"
    }
  ]
}