Linux kernel (net/tls): If a page allocation fails while the TLS strparser is copying a partial record, the receive

Impact

If a page allocation fails while the TLS strparser is copying a partial record, the receive queue's frag_list is left NULL while full_len still says a record is in flight. The next data_ready dereferences NULL inside the TCP receive softirq - a kernel panic in interrupt context, taking the whole node and every tenant on it.

Who can reach it

Any kTLS RX socket on the node plus memory pressure. A co-tenant can create the pressure (that is a normal condition on a packed GPU node), and the peer keeps feeding partial records; the crash lands in tcp_data_queue -> tls_data_ready -> tls_strp_check_rcv, not in a task context that can be killed cleanly.

What to do

Boot a kernel carrying the linked stable commits. Interim: keep hard memory limits and reserves on tenant cgroups so the node does not enter page-allocation failure while kTLS connections are live.

References