[PATCH net v4 0/2] net/rds: scope-aware sendmsg connection cache

[Allison Henderson <achender@kernel.org>]

Hi all,

This is v4 of the sendmsg connection-cache scope fix (v1 at [1], v2 at
[2], v3 at [3]).

  Patch 1 gives the connected peer's link-local scope its own field.
  rds_connect() used to store it in rs_bound_scope_id, the scope of
  the socket's own bound address, which a later bind() to a
  non-link-local address resets to 0 and which a later connect()
  pollutes for a globally bound socket.  A send without a destination,
  getpeername() and recvmsg() now take the connected peer's scope from
  that field.

  Patch 2 compares c_dev_if with the request's scope in the cache-hit
  test, so the cache uses the same key as rds_conn_lookup().

Both were found by inspection while reworking this cache for the
connection-lifetime series on net-next; neither has been observed in
the field.  The misdelivery in patch 2 needs a socket that sends to
the same link-local address through two interfaces, and the stall in
patch 1 a connect()/bind() order that loses the peer's scope.

Changes since v3 [3]:
 - Patch 1: a destination-less send falls back to the bound scope for a
   non-link-local peer, so send() and sendto() to the connected peer
   compute the same scope (review of v3: a socket bound link-local and
   connected to a global peer stalled otherwise); getpeername() and
   recvmsg() report the connected peer's scope instead of the bound
   scope (review of v3).
 - Commit messages say how the issues were found.

Changes since v2 [2]:
 - The v2 "scope 0 matches anything" wildcard is gone; the
   destination-less send carries the connected peer's scope instead
   (new patch 1), and the comparison is exact.

[1] https://lore.kernel.org/netdev/20260921215046.174745-1-achender@kernel.org/
[2] https://lore.kernel.org/netdev/20260927062312.169097-1-achender@kernel.org/
[3] https://lore.kernel.org/netdev/20261003163526.250805-1-achender@kernel.org/

Thank you,
Allison


Allison Henderson (2):
  net/rds: keep the connected peer's scope id apart from the bound one
  net/rds: include the scope id in the sendmsg connection cache check

 net/rds/af_rds.c | 15 +++++++++------
 net/rds/bind.c   |  4 ++--
 net/rds/rds.h    |  2 ++
 net/rds/recv.c   |  3 ++-
 net/rds/send.c   |  9 +++++++--
 5 files changed, 22 insertions(+), 11 deletions(-)

-- 
2.25.1