[PATCH net-next v17 07/15] net: sched: re-validate parked decrypted skbs on requeue
From: Rishikesh Jethwani <hidden>
Date: 2026-09-17 22:45:17
Subsystem:
networking [general], tc subsystem, the rest · Maintainers:
"David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Jamal Hadi Salim, Jiri Pirko, Linus Torvalds
A still-cleartext skb of a crypto-offloaded socket was validated against that socket's offload state (sk->sk_validate_xmit_skb) at the time it was enqueued. That state can change while the skb is parked on the qdisc, e.g. a TLS key update or offload teardown, so re-validate it on requeue, letting the current callback decide how it reaches the wire instead of emitting now-unencrypted plaintext. This is a prerequisite for TLS 1.3 device-offload KeyUpdate support, which swaps the offload state of a live connection. Signed-off-by: Rishikesh Jethwani <redacted> --- net/sched/sch_generic.c | 9 +++++++++ 1 file changed, 9 insertions(+)
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 6f6a6f0d5eb0..fc8ef0d13f5e 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c@@ -285,6 +285,15 @@ static struct sk_buff *dequeue_skb(struct Qdisc *q, bool *validate, *validate = false; if (xfrm_offload(skb)) *validate = true; + /* A still-cleartext skb of a crypto-offloaded socket was validated + * against that socket's offload state at the time. That state + * (sk->sk_validate_xmit_skb) can change while the skb is parked here + * e.g. a TLS key update or offload teardown, so re-validate it, + * letting the current callback decide how it reaches the wire instead + * of emitting now-unencrypted plaintext. + */ + if (skb_is_decrypted(skb)) + *validate = true; /* check the reason of requeuing without tx lock first */ txq = skb_get_tx_queue(txq->dev, skb); if (!netif_xmit_frozen_or_stopped(txq)) {
--
2.50.1