Re: [PATCH net] net/rds: ib: drop fragments shorter than the header-declared length

[sashiko-bot@kernel.org]

> rds_ib_process_recv() accepts an incoming RDS/IB fragment once the
> receive completion reports at least an RDS header
> (data_len >= sizeof(struct rds_header)).  It then trusts the
> header-declared total message length h_len: for the first fragment of
> a message it stores be32_to_cpu(hdr->h_len) in ic->i_recv_data_rem,
> and rds_ib_inc_copy_to_user() later copies up to h_len bytes from the
> fragment pages to userspace on recvmsg().
> 
> The number of payload bytes actually received into the fragment page is
> data_len (after subtracting the header), but it is never checked against
> the amount the fragment is accounted to contribute to the message,
> min(i_recv_data_rem, RDS_FRAG_SIZE).  A fragment whose header advertises
> a larger h_len than the payload it delivers is still linked onto the
> reassembly list.  The fragment page comes from the per-CPU receive cache
> and is not zeroed, so rds_ib_inc_copy_to_user() then copies up to h_len
> bytes to the PF_RDS reader, including the uninitialized tail the receive
> never wrote.
> 
> Reject a fragment that carries fewer payload bytes than it is accounted
> to contribute before linking it onto the reassembly list.
> 
> The issue is reproducible under KMSAN with two hosts over rdma_rxe
> (Soft-RoCE); the same reproducer confirms the fix stops it.
> 
> Fixes: 1e23b3ee0e94 ("RDS/IB: Receive datagrams via IB")
> Assisted-by: Claude:claude-opus-4-8
> Signed-off-by: Shubham Antil <shubham@octane.security>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261006125720.81227-1-shubham@octane.security?part=1