Re: [PATCH net] net/smc: queue the copied chunk when smc_tx_sendmsg() faults

[sashiko-bot@kernel.org]

> From: Bryam Vargas <hexlabsecurity@proton.me>
> 
> When a send wraps the end of the send buffer, smc_tx_sendmsg() copies
> the data in two chunks. If memcpy_from_msg() faults on the second one,
> smc_tx_sendmsg() returns send_done, which already counts the first
> chunk, but leaves tx_curs_prep and sndbuf_space as they were. send()
> reports bytes the peer never receives, and the next send() overwrites
> them. Any caller can hit this on its own stream with a buffer whose
> tail is unreadable.
> 
> On a fault in the second chunk, queue the first one. The next pass
> retries the rest and returns send_done if it faults again, so send()
> reports only what it queued, as TCP does.
> 
> Fixes: e6727f39004b ("smc: send data (through RDMA)")
> Cc: stable@vger.kernel.org
> Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261013-b4-disp-872a3689-v1-1-2a4c63b04761@proton.me?part=1