Re: [PATCH net v2] rds: fix out-of-bounds conn_path walks via handshake exthdrs

[sashiko-bot@kernel.org]

> Both the lane and the connection-generation negotiation are driven by
> extension headers in handshake packets, and both are processed
> unconditionally, even on transports that are not multipath capable.
> A non-MP connection (t_mp_capable unset) owns exactly one
> rds_conn_path slot, so a peer claiming up to RDS_MPATH_WORKERS lanes
> makes every subsequent fan-out walk conn->c_path[0..7] at 504-byte
> strides past the single allocated slot (KASAN: "Read of size 8 in
> rds_conn_path_connect_if_down"); the generation negotiation opens a
> similar out-of-bounds walk on the same array.
> 
> Only process handshake extension headers when the connection's
> transport is multipath capable, so a peer can never make us walk
> lanes that do not exist.  Both call sites in rds_recv_incoming() are
> gated.
> 
> This is a port of the Oracle UEK fix for the same issue, picked up
> where Paula's series of the same change left off.
> 
> This issue was discovered by Tencent CodeBuddy Security.
> 
> Cc: stable@vger.kernel.org
> Link: https://lore.kernel.org/netdev/20260825120132.51636-1-pamoutafpro@gmail.com/
> Link: https://github.com/oracle/linux-uek/commit/2fdeb0513f18
> Fixes: 840df162b3eb ("rds: reduce memory footprint for RDS when transport is RDMA")
> Fixes: 905dd4184e07 ("RDS: TCP: Track peer's connection generation number")
> Signed-off-by: Henry Martin <bsdhenrymartin@gmail.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261012025336.54756-1-bsdhenrymartin@gmail.com?part=1