From: Vakul Garg <vakul.g...@nxp.com>
Date: Sat, 9 Feb 2019 07:53:28 +0000
> Function tls_sw_recvmsg() dequeues multiple records from stream parser
> and decrypts them. In case the decryption is done by async accelerator,
> the records may get submitted for decryption while the previous ones may
> not have been decryted yet. For tls1.3, the record type is known only
> after decryption. Therefore, for tls1.3, tls_sw_recvmsg() may submit
> records for decryption even if it gets 'handshake' records after 'data'
> records. These intermediate 'handshake' records may do a key updation.
> By the time new keys are given to ktls by userspace, it is possible that
> ktls has already submitted some records i(which are encrypted with new
> keys) for decryption using old keys. This would lead to decrypt failure.
> Therefore, async decryption of records should be disabled for tls1.3.
>
> Fixes: 130b392c6cd6b ("net: tls: Add tls 1.3 support")
> Signed-off-by: Vakul Garg <vakul.g...@nxp.com>
Applied, thank you.
