Re: [PATCH v3 2/8] tls: Factor tls_rx_decrypt_record() helper

On Thu, Mar 12, 2026 at 11:48 AM Chuck Lever <[email protected]> wrote:
>
> From: Chuck Lever <[email protected]>
>
> recvmsg, read_sock, and splice_read each open-code the
> same sequence: zero-initialize the decrypt arguments, call
> tls_rx_one_record(), and abort the connection on failure.
>
> Extract tls_rx_decrypt_record() so each receive path shares
> a single decrypt-and-abort primitive. Each call site still
> initializes darg.inargs separately, since recvmsg sets zc
> and async between the memset and the decrypt call.
>
> Reviewed-by: Hannes Reinecke <[email protected]>
> Signed-off-by: Chuck Lever <[email protected]>

Reviewed-by: Alistair Francis <[email protected]>

Alistair

> ---
>  net/tls/tls_sw.c | 29 +++++++++++++++++------------
>  1 file changed, 17 insertions(+), 12 deletions(-)
>
> diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
> index cedcc82669db..81e0e8aaa6f9 100644
> --- a/net/tls/tls_sw.c
> +++ b/net/tls/tls_sw.c
> @@ -1832,6 +1832,17 @@ static int tls_rx_one_record(struct sock *sk, struct msghdr *msg,
>         return tls_check_pending_rekey(sk, tls_ctx, darg->skb);
>  }
>
> +/* Decrypt one record and abort the connection on failure. */
> +static int tls_rx_decrypt_record(struct sock *sk, struct msghdr *msg,
> +                                struct tls_decrypt_arg *darg)
> +{
> +       int err = tls_rx_one_record(sk, msg, darg);
> +
> +       if (err < 0)
> +               tls_err_abort(sk, -EBADMSG);
> +       return err;
> +}
> +
>  int decrypt_skb(struct sock *sk, struct scatterlist *sgout)
>  {
>         struct tls_decrypt_arg darg = { .zc = true, };
> @@ -2132,11 +2143,9 @@ int tls_sw_recvmsg(struct sock *sk,
>                 else
>                         darg.async = false;
>
> -               err = tls_rx_one_record(sk, msg, &darg);
> -               if (err < 0) {
> -                       tls_err_abort(sk, -EBADMSG);
> +               err = tls_rx_decrypt_record(sk, msg, &darg);
> +               if (err < 0)
>                         goto recv_end;
> -               }
>
>                 async |= darg.async;
>
> @@ -2294,11 +2303,9 @@ ssize_t tls_sw_splice_read(struct socket *sock,  loff_t *ppos,
>
>                 memset(&darg.inargs, 0, sizeof(darg.inargs));
>
> -               err = tls_rx_one_record(sk, NULL, &darg);
> -               if (err < 0) {
> -                       tls_err_abort(sk, -EBADMSG);
> +               err = tls_rx_decrypt_record(sk, NULL, &darg);
> +               if (err < 0)
>                         goto splice_read_end;
> -               }
>
>                 tls_rx_rec_done(ctx);
>                 skb = darg.skb;
> @@ -2380,11 +2387,9 @@ int tls_sw_read_sock(struct sock *sk, read_descriptor_t *desc,
>
>                         memset(&darg.inargs, 0, sizeof(darg.inargs));
>
> -                       err = tls_rx_one_record(sk, NULL, &darg);
> -                       if (err < 0) {
> -                               tls_err_abort(sk, -EBADMSG);
> +                       err = tls_rx_decrypt_record(sk, NULL, &darg);
> +                       if (err < 0)
>                                 goto read_sock_end;
> -                       }
>
>                         released = tls_read_flush_backlog(sk, prot, INT_MAX,
>                                                           0, decrypted,
> --
> 2.52.0
>
>