Re: [PATCH 5.10.y 1/2] net/smc: check smcd_v2_ext_offset when receiving proposal msg

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] net/smc: protocol regression in SMCv2 proposal parsing due to static max_offset
--

commit 32692cd08a75040e1005cf9b8d09a85a6a7acc74
Author: Guangguan Wang <guangguan.wang@linux.alibaba.com>

net/smc: check smcd_v2_ext_offset when receiving proposal msg
    
When receiving proposal msg in server, the field smcd_v2_ext_offset in
proposal msg is from the remote client and can not be fully trusted.
Once the value of smcd_v2_ext_offset exceed the max value, there has
the chance to access wrong address, and crash may happen.

> diff --git a/net/smc/smc_clc.h b/net/smc/smc_clc.h
> index a57a3489df4ae..f7f656b297f9c 100644
> --- a/net/smc/smc_clc.h
> +++ b/net/smc/smc_clc.h
> @@ -306,9 +306,15 @@ smc_get_clc_v2_ext(struct smc_clc_msg_proposal *prop)
>  static inline struct smc_clc_smcd_v2_extension *
>  smc_get_clc_smcd_v2_ext(struct smc_clc_v2_extension *prop_v2ext)
>  {
> +	u16 max_offset = offsetof(struct smc_clc_msg_proposal_area, pclc_smcd_v2_ext) -
> +		offsetof(struct smc_clc_msg_proposal_area, pclc_v2_ext) -
> +		offsetof(struct smc_clc_v2_extension, hdr) -
> +		offsetofend(struct smc_clnt_opts_area_hdr, smcd_v2_ext_offset);
> +

[Severity: High]
Does this static calculation ignore the dynamic size of the flexible
user_eids array in struct smc_clc_v2_extension?

By not accounting for the user_eids array, max_offset appears strictly
limited to the case where eid_cnt = 0.

>  	if (!prop_v2ext)
>  		return NULL;
> -	if (!ntohs(prop_v2ext->hdr.smcd_v2_ext_offset))
> +	if (!ntohs(prop_v2ext->hdr.smcd_v2_ext_offset) ||
> +	    ntohs(prop_v2ext->hdr.smcd_v2_ext_offset) > max_offset)
>  		return NULL;

[Severity: High]
Will this falsely flag valid offsets as out-of-bounds when the proposal
includes user EIDs?

When an untrusted remote peer initiates an SMC-D v2 connection proposing
one or more user EIDs (up to SMC_CLC_MAX_UEID), the packet may be
correctly sized and well-formed.

However, because max_offset ignores the flexible user_eids array, this
check returns NULL and drops the capability, breaking protocol compliance
and interoperability with SMCv2 peers that use Enterprise IDs.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260920051403.712116-1-junjie.cao@intel.com?part=1