tls_sw_splice_read() takes its blocking behavior from SPLICE_F_NONBLOCK alone. When splicing from a socket to a pipe, do_splice() sets that flag from the pipe's O_NONBLOCK, not the socket's. On a nonblocking socket, a splice(2) call without SPLICE_F_NONBLOCK therefore sleeps in tls_rx_rec_wait() until a record arrives. tcp_splice_read() instead reads sock->file->f_flags and returns -EAGAIN. Poll makes the sleep reachable. tls_sw_sock_is_readable() reports the socket readable while any record sits on rx_list, including a zero-length record that delivers no bytes to the pipe. The strparser announces a record before decryption, when its plaintext length is unknown, so the readiness test cannot screen such a record out. The splice consumes it and waits for the next, and an event loop that polls and then splices stalls every connection it multiplexes. Treat the socket's O_NONBLOCK as nonblocking too. A caller that sets O_NONBLOCK and splices without SPLICE_F_NONBLOCK, taking that flag to govern only the pipe, now gets -EAGAIN where it blocked before. sendfile(2) from a TLS socket changes the same way, because do_sendfile() leaves the input file's O_NONBLOCK out of the splice flags. Both now behave as they do on a plain TCP socket. Fixes: c46234ebb4d1 ("tls: RX path for ktls") Signed-off-by: Chuck Lever --- net/tls/tls_sw.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c index 79a807e51bc7..6ca1e9f4e504 100644 --- a/net/tls/tls_sw.c +++ b/net/tls/tls_sw.c @@ -2020,10 +2020,14 @@ ssize_t tls_sw_splice_read(struct socket *sock, loff_t *ppos, struct sk_buff *skb; bool released = true; ssize_t copied = 0; + bool nonblock; int chunk; int err; - err = tls_rx_reader_lock(sk, ctx, flags & SPLICE_F_NONBLOCK); + nonblock = (flags & SPLICE_F_NONBLOCK) || + (sock->file->f_flags & O_NONBLOCK); + + err = tls_rx_reader_lock(sk, ctx, nonblock); if (err < 0) return err; @@ -2038,8 +2042,7 @@ ssize_t tls_sw_splice_read(struct socket *sock, loff_t *ppos, } else { struct tls_decrypt_arg darg; - err = tls_rx_rec_wait(sk, flags & SPLICE_F_NONBLOCK, - released, false); + err = tls_rx_rec_wait(sk, nonblock, released, false); if (err <= 0) goto splice_read_end; @@ -2069,10 +2072,7 @@ ssize_t tls_sw_splice_read(struct socket *sock, loff_t *ppos, if (rxm->full_len == 0) { consume_skb(skb); if (signal_pending(current)) { - long timeo; - - timeo = sock_rcvtimeo(sk, flags & SPLICE_F_NONBLOCK); - err = sock_intr_errno(timeo); + err = sock_intr_errno(sock_rcvtimeo(sk, nonblock)); goto splice_read_end; } goto retry; -- 2.55.0