Re: [PATCH net] RDS/IB: validate receive completion payload length

[sashiko-bot@kernel.org]

> An RDS/RDMA peer can declare a fragment length larger than the payload
> reported by the receive completion. The receive path attaches the recycled
> receive fragment without validating those lengths, allowing recvmsg() to
> return stale bytes beyond the actual payload.
> 
> Validate data_len against the expected current-fragment length before
> transferring fragment ownership. Disconnect and reconnect on mismatch.
> 
> The issue reproduced in two clean QEMU boots. A peer declared 4096 bytes
> while posting only 16 bytes, and a receiver under a different UID obtained
> 4080-byte tails from prior messages in all 256 attempts in each boot. With
> this change, the malformed message was not delivered, reconnection
> succeeded, and a subsequent normal 4096-byte message was delivered intact.
> 
> Fixes: 1e23b3ee0e94 ("RDS/IB: Receive datagrams via IB")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: sungbyeongchan <tjdqudcks0424@naver.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261006205204.1322102-1-tjdqudcks0424@naver.com?part=1