Commit 285943c6e7ca for kernel

commit 285943c6e7ca309bbea84b253745154241d9788a
Author: Jakub Kicinski <kuba@kernel.org>
Date:   Mon May 11 10:49:17 2026 -0700

    net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring

    When an sk_msg scatterlist ring wraps (sg.end < sg.start),
    tls_push_record() chains the tail portion of the ring to the head
    using sg_chain(). An extra entry in the sg array is reserved for
    this:

      struct sk_msg_sg {
            [...]
            /* The extra two elements:
             * 1) used for chaining the front and sections when the list becomes
             *    partitioned (e.g. end < start). The crypto APIs require the
             *    chaining;
             * 2) to chain tailer SG entries after the message.
             */
            struct scatterlist              data[MAX_MSG_FRAGS + 2];

    The current code uses MAX_SKB_FRAGS + 1 as the ring size:

        sg_chain(&msg_pl->sg.data[msg_pl->sg.start],
                 MAX_SKB_FRAGS - msg_pl->sg.start + 1,
                 msg_pl->sg.data);

    This places the chain pointer at

      sg_chain(data[start], (MAX_SKB_FRAGS - msg_start + 1) .. =
      &data[start] + (MAX_SKB_FRAGS - msg_start + 1) - 1 =
      data[start + (MAX_SKB_FRAGS - start + 1) - 1] =
      data[MAX_SKB_FRAGS]

    instead of the true last entry. This is likely due to a "race" of
    the commit under Fixes landing close to
    commit 031097d9e079 ("bpf: sk_msg, zap ingress queue on psock down")

    Convert to ARRAY_SIZE and drop the data[start] / - start (as suggested
    by Sabrina).

    Reported-by: 钱一铭 <yimingqian591@gmail.com>
    Fixes: 9aaaa56845a0 ("bpf: Sockmap/tls, skmsg can have wrapped skmsg that needs extra chaining")
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
    Link: https://patch.msgid.link/20260511174920.433155-2-kuba@kernel.org
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>

diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
index 2590e855f6a5..2608b0c01849 100644
--- a/net/tls/tls_sw.c
+++ b/net/tls/tls_sw.c
@@ -800,11 +800,9 @@ static int tls_push_record(struct sock *sk, int flags,
 		sg_mark_end(sk_msg_elem(msg_pl, i));
 	}

-	if (msg_pl->sg.end < msg_pl->sg.start) {
-		sg_chain(&msg_pl->sg.data[msg_pl->sg.start],
-			 MAX_SKB_FRAGS - msg_pl->sg.start + 1,
+	if (msg_pl->sg.end < msg_pl->sg.start)
+		sg_chain(msg_pl->sg.data, ARRAY_SIZE(msg_pl->sg.data),
 			 msg_pl->sg.data);
-	}

 	i = msg_pl->sg.start;
 	sg_chain(rec->sg_aead_in, 2, &msg_pl->sg.data[i]);