Re: [PATCH net-next 14/15] net/tls: don't BUG() on leftover length in __skb_nsg()

[Willem de Bruijn <willemdebruijn.kernel@xxxxxxxxx>]

On Mon, Oct 19, 2026 at 11:13 AM Mina Almasry <almasrymina@xxxxxxxxxx> wrote:
>
> On Mon, Oct 19, 2026 at 6:51 AM Josef Bacik <josef@xxxxxxxxxxxxxx> wrote:
> >
> > __skb_nsg() counts the scatterlist entries for a range of an skb with a
> > copy of the __skb_to_sgvec() walk, including its BUG_ON(len) when the
> > skb runs out before the range does.  tls_decrypt_sg() calls it on the
> > same range it then passes to skb_to_sgvec(), so a bad range would BUG()
> > here before it got to skb_to_sgvec()'s error return.
> >
> > __skb_nsg() already returns -EMSGSIZE for a frag_list nested too deep,
> > and tls_decrypt_sg() fails the record on any return below 1.  Return
> > -EINVAL for the leftover length too, with a DEBUG_NET_WARN_ON_ONCE() for
> > debug kernels.
> >
> > Assisted-by: LLM
> > Signed-off-by: Josef Bacik <josef@xxxxxxxxxxxxxx>
> > ---
> >  net/tls/tls_sw.c | 5 ++++-
> >  1 file changed, 4 insertions(+), 1 deletion(-)
> >
> > diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
> > index 312e51270f29..1c578ea47a1b 100644
> > --- a/net/tls/tls_sw.c
> > +++ b/net/tls/tls_sw.c
> > @@ -142,7 +142,10 @@ static int __skb_nsg(struct sk_buff *skb, int offset, 
> > int len,
> >                          start = end;
> >                  }
> >          }
> > -        BUG_ON(len);
> > +       if (unlikely(len)) {
> > +               DEBUG_NET_WARN_ON_ONCE(1);
> > +               return -EINVAL;
> > +       }
>
> Ugh, why DEBUG_NET_WARN...? Seems WARN_ON_ONCE() is more appropriate,
> after all we're downgrading from a BUG_ON(). Another nice thing is
> that it could have been done inline:

Because that still triggers on systems with panic_on_warn. See also

https://lore.kernel.org/all/willemdebruijn.kernel.140f4eac91ab3@xxxxxxxxx/