Re: [PATCH] RDMA/core: Fix partial copy of IPv6 flow_lbl in LAG hash skb

[sashiko-bot@kernel.org]

> From: Li RongQing <lirongqing@baidu.com>
> 
> rdma_build_skb() constructs a synthetic IPv6 header for LAG slave
> selection and copies the flow label from the AH attribute:
> 
> 	memcpy(&ip6h->flow_lbl, &ah_attr->grh.flow_label,
> 	       sizeof(*ip6h->flow_lbl));
> 
> ipv6hdr.flow_lbl is __u8[3], so sizeof(*ip6h->flow_lbl) dereferences the
> array to a single __u8 and yields 1.  The memcpy therefore copies only
> the first byte of the flow label, leaving flow_lbl[1] and flow_lbl[2]
> uninitialised in the skb buffer (alloc_skb() does not zero the data).
> The resulting LAG hash is computed over one byte of real flow-label
> data and two bytes of kmalloc residue, so IPv6 RoCEv2 traffic on a
> bonded interface can be steered to the wrong slave.
> 
> Use sizeof(ip6h->flow_lbl) (the array, 3 bytes) so the whole flow label
> is copied.
> 
> Fixes: bd3920eac1331 ("RDMA/core: Add LAG functionality")
> Signed-off-by: Li RongQing <lirongqing@baidu.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260916120926.1761-1-lirongqing@baidu.com?part=1