git: 8eeba7ea1f96 - stable/15 - ktls CBC decrypt: Avoid creating zero length iovec entries

The branch stable/15 has been updated by jhb:

URL: https://cgit.FreeBSD.org/src/commit/?id=8eeba7ea1f965160cd759a2296eb53aa7a4c4770

commit 8eeba7ea1f965160cd759a2296eb53aa7a4c4770
Author:     John Baldwin <jhb@FreeBSD.org>
AuthorDate: 2026-06-30 18:11:29 +0000
Commit:     John Baldwin <jhb@FreeBSD.org>
CommitDate: 2026-10-08 20:42:31 +0000

    ktls CBC decrypt: Avoid creating zero length iovec entries
    
    If an mbuf's length in the chain for an encrypted TLS record exactly
    matches the remaining length of header bytes to skip, skip the mbuf
    entirely rather than adding a zero-length iovec entry.
    
    Sponsored by:   Chelsio Communications
    
    (cherry picked from commit 1756d1cab3ce28085eec94a45c557e1af265ccd0)
---
 sys/opencrypto/ktls_ocf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sys/opencrypto/ktls_ocf.c b/sys/opencrypto/ktls_ocf.c
index e61f607622b0..792b08650deb 100644
--- a/sys/opencrypto/ktls_ocf.c
+++ b/sys/opencrypto/ktls_ocf.c
@@ -501,7 +501,7 @@ ktls_ocf_tls_cbc_decrypt(struct ktls_session *tls,
 	iov[0].iov_len = sizeof(ad);
 	skip = sizeof(*hdr) + AES_BLOCK_LEN;
 	for (i = 1, n = m; n != NULL; n = n->m_next) {
-		if (n->m_len < skip) {
+		if (n->m_len <= skip) {
 			skip -= n->m_len;
 			continue;
 		}