tls_rx_msg_size() tells the device layer where each new record starts, via tls_device_rx_resync_new_rec(), as TCP_SKB_CB(skb)->seq + strp->stm.offset. skb is the strparser anchor, whose cb is copied from the first queued skb by tls_strp_load_anchor_with_queue(), and stm.offset is where the record starts within that skb. When the header cannot be parsed in place, tls_strp_read_copy() moves the strparser to copy mode and resets stm.offset to 0, but the anchor keeps the first skb's cb. The header is then parsed from the copied data, and the reported start is the first byte of that skb rather than of the record. If the record does not begin at an skb boundary, the sequence is too low by the record's offset into the skb. Every resync type compares or advances that sequence. With TLS_OFFLOAD_SYNC_TYPE_DRIVER_REQ and DRIVER_REQ_ASYNC the device's request no longer matches and the resync is missed until a later record. With TLS_OFFLOAD_SYNC_TYPE_CORE_NEXT_HINT the device is given a next-record boundary that is off by the same amount. The header is parsed in copy mode when fewer bytes than the TLS header plus explicit IV, where applicable, are queued under memory pressure or with a collapsed receive window, or when the header straddles skbs that overlap or differ in decrypted status. The latter is most likely right around a loss of device sync, when resync is needed. Commit 9466ef3ec972 ("tls: fix RX desync on overlapping skbs") added that queue-consistency check before the header is parsed; before it only a short queue led here. The strparser now records the start of each record before it can enter copy mode, so report strp->seq instead. Found by code inspection while working on TLS 1.3 hardware offload support. Fixes: 84c61fe1a75b ("tls: rx: do not use the standard strparser") Signed-off-by: Rishikesh Jethwani --- net/tls/tls_sw.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c index d1ad31986cf2..5db4a6897b29 100644 --- a/net/tls/tls_sw.c +++ b/net/tls/tls_sw.c @@ -2232,7 +2232,7 @@ int tls_rx_msg_size(struct tls_strparser *strp, struct sk_buff *skb) } tls_device_rx_resync_new_rec(strp->sk, data_len + TLS_HEADER_SIZE, - TCP_SKB_CB(skb)->seq + strp->stm.offset); + strp->seq); return data_len + TLS_HEADER_SIZE; read_failure: -- 2.50.1