[PATCH] RDMA/cma: Fix hardware address comparison length in netevent callback

[PATCH] RDMA/cma: Fix hardware address comparison length in netevent callback

[Or Gerlitz via B4 Relay]

From: Or Gerlitz <ogerlitz@ddn.com>

The cited commit hardcoded the hardware address comparison len to ETH_ALEN.

This breaks IPoIB, which uses 20-byte addresses. By truncating the
memcmp, the CMA may incorrectly assume the target address is
unchanged and fails to abort the stalled connection.

Fix this by replacing ETH_ALEN with the dynamic neigh->dev->addr_len
to correctly evaluate the full address regardless of the link layer.

Fixes: 925d046e7e52 ("RDMA/core: Add a netevent notifier to cma")
Signed-off-by: Or Gerlitz <ogerlitz@ddn.com>
---
I caught this while reviewing the RoCE netevent callback, 
the patch is compile-tested only..
---
 drivers/infiniband/core/cma.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index 9480d1a51c11..e88d3efb967b 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -5270,7 +5270,7 @@ static int cma_netevent_callback(struct notifier_block *self,
 
 	list_for_each_entry(current_id, &ips_node->id_list, id_list_entry) {
 		if (!memcmp(current_id->id.route.addr.dev_addr.dst_dev_addr,
-			   neigh->ha, ETH_ALEN))
+			   neigh->ha, neigh->dev->addr_len))
 			continue;
 		cma_id_get(current_id);
 		if (!queue_work(cma_wq, &current_id->id.net_work))

---
base-commit: 4b99990cdf9560e8a071640baf19f312e6ae02f4
change-id: 20260617-fix-cma-ipoib-e6a8bfe159f8

Best regards,
-- 
Or Gerlitz <ogerlitz@ddn.com>

[PATCH] RDMA/cma: Fix hardware address comparison length in netevent callback

[Or Gerlitz]

The cited commit hardcoded the hardware address comparison len to ETH_ALEN.

This breaks IPoIB, which uses 20-byte addresses. By truncating the
memcmp, the CMA may incorrectly assume the target address is
unchanged and fails to abort the stalled connection.

Fix this by replacing ETH_ALEN with the dynamic neigh->dev->addr_len
to correctly evaluate the full address regardless of the link layer.

Fixes: 925d046e7e52 ("RDMA/core: Add a netevent notifier to cma")
Signed-off-by: Or Gerlitz <ogerlitz@ddn.com>
---
I caught this while reviewing the RoCE netevent callback, 
the patch is compile-tested only..
---
 drivers/infiniband/core/cma.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index 9480d1a51c11..e88d3efb967b 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -5270,7 +5270,7 @@ static int cma_netevent_callback(struct notifier_block *self,
 
 	list_for_each_entry(current_id, &ips_node->id_list, id_list_entry) {
 		if (!memcmp(current_id->id.route.addr.dev_addr.dst_dev_addr,
-			   neigh->ha, ETH_ALEN))
+			   neigh->ha, neigh->dev->addr_len))
 			continue;
 		cma_id_get(current_id);
 		if (!queue_work(cma_wq, &current_id->id.net_work))

---
base-commit: 4b99990cdf9560e8a071640baf19f312e6ae02f4
change-id: 20260617-fix-cma-ipoib-e6a8bfe159f8

Best regards,
-- 
Or Gerlitz <ogerlitz@ddn.com>

Re: [PATCH] RDMA/cma: Fix hardware address comparison length in netevent callback

[Leon Romanovsky]

On Wed, Jun 17, 2026 at 02:21:05PM +0300, Or Gerlitz via B4 Relay wrote:
> From: Or Gerlitz <ogerlitz@ddn.com>
> 
> The cited commit hardcoded the hardware address comparison len to ETH_ALEN.
> 
> This breaks IPoIB, which uses 20-byte addresses. By truncating the
> memcmp, the CMA may incorrectly assume the target address is
> unchanged and fails to abort the stalled connection.
> 
> Fix this by replacing ETH_ALEN with the dynamic neigh->dev->addr_len
> to correctly evaluate the full address regardless of the link layer.
> 
> Fixes: 925d046e7e52 ("RDMA/core: Add a netevent notifier to cma")
> Signed-off-by: Or Gerlitz <ogerlitz@ddn.com>
> ---
> I caught this while reviewing the RoCE netevent callback, 
> the patch is compile-tested only..
> ---
>  drivers/infiniband/core/cma.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

Looks correct to me.

Thanks,
Reviewed-by: Leon Romanovsky <leon@kernel.org>