net: tls: explicitly disallow disconnect

JIRA: https://issues.redhat.com/browse/RHEL-115640

commit 5071a1e
Author: Jakub Kicinski <kuba@kernel.org>
Date:   Fri Apr 4 11:03:33 2025 -0700

    net: tls: explicitly disallow disconnect

    syzbot discovered that it can disconnect a TLS socket and then
    run into all sort of unexpected corner cases. I have a vague
    recollection of Eric pointing this out to us a long time ago.
    Supporting disconnect is really hard, for one thing if offload
    is enabled we'd need to wait for all packets to be _acked_.
    Disconnect is not commonly used, disallow it.

    The immediate problem syzbot run into is the warning in the strp,
    but that's just the easiest bug to trigger:

      WARNING: CPU: 0 PID: 5834 at net/tls/tls_strp.c:486 tls_strp_msg_load+0x72e/0xa80 net/tls/tls_strp.c:486
      RIP: 0010:tls_strp_msg_load+0x72e/0xa80 net/tls/tls_strp.c:486
      Call Trace:
       <TASK>
       tls_rx_rec_wait+0x280/0xa60 net/tls/tls_sw.c:1363
       tls_sw_recvmsg+0x85c/0x1c30 net/tls/tls_sw.c:2043
       inet6_recvmsg+0x2c9/0x730 net/ipv6/af_inet6.c:678
       sock_recvmsg_nosec net/socket.c:1023 [inline]
       sock_recvmsg+0x109/0x280 net/socket.c:1045
       __sys_recvfrom+0x202/0x380 net/socket.c:2237

    Fixes: 3c4d755 ("tls: kernel TLS support")
    Reported-by: syzbot+b4cd76826045a1eb93c1@syzkaller.appspotmail.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Reviewed-by: Eric Dumazet <edumazet@google.com>
    Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
    Link: https://patch.msgid.link/20250404180334.3224206-1-kuba@kernel.org
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>

Signed-off-by: Sabrina Dubroca <sdubroca@redhat.com>

Author: Sabrina Dubroca

net/tls/tls_main.c

@@ -803,6 +803,11 @@ static int tls_setsockopt(struct sock *sk, int level, int optname,
 	return do_tls_setsockopt(sk, optname, optval, optlen);
 }
 
+static int tls_disconnect(struct sock *sk, int flags)
+{
+	return -EOPNOTSUPP;
+}
+
 struct tls_context *tls_ctx_create(struct sock *sk)
 {
 	struct inet_connection_sock *icsk = inet_csk(sk);
@@ -901,6 +906,7 @@ static void build_protos(struct proto prot[TLS_NUM_CONFIG][TLS_NUM_CONFIG],
 	prot[TLS_BASE][TLS_BASE] = *base;
 	prot[TLS_BASE][TLS_BASE].setsockopt	= tls_setsockopt;
 	prot[TLS_BASE][TLS_BASE].getsockopt	= tls_getsockopt;
+	prot[TLS_BASE][TLS_BASE].disconnect	= tls_disconnect;
 	prot[TLS_BASE][TLS_BASE].close		= tls_sk_proto_close;
 
 	prot[TLS_SW][TLS_BASE] = prot[TLS_BASE][TLS_BASE];