Re: [PATCH rdma-next 3/3] RDMA/core: Reject LAG selection when source MAC lookup fails

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] rdma: KMSAN uninit-value in rdma_build_skb due to partial header init
--

commit fe2a587fde347fe9ebd760de282337658857e55d
Author: Leon Romanovsky <leon@kernel.org>

RDMA/core: Reject LAG selection when source MAC lookup fails

GID deletion can clear the source device association after LAG lookup
retains the bonding master. Ignoring the resulting L2 lookup failure
copies uninitialized source MAC bytes into the synthetic hash packet.
This commit reads the source MAC before allocating the packet and
propagates lookup errors to the caller.

> diff --git a/drivers/infiniband/core/lag.c b/drivers/infiniband/core/lag.c
> index 88aac911e8ee1..651c868aa04e5 100644
> --- a/drivers/infiniband/core/lag.c
> +++ b/drivers/infiniband/core/lag.c
[ ... ]
> @@ -26,7 +31,7 @@ static struct sk_buff *rdma_build_skb(struct net_device *netdev,
>  
>  	skb = alloc_skb(hdr_len, flags);
>  	if (!skb)
> -		return NULL;
> +		return ERR_PTR(-ENOMEM);

[Severity: Medium]
Does this code expose uninitialized kernel memory to flow dissectors?

Since alloc_skb() leaves the data buffer uninitialized, bitfield assignments
performed later in rdma_build_skb():

	if (is_ipv4) {
		skb_push(skb, sizeof(struct iphdr));
		skb_reset_network_header(skb);
		iph = ip_hdr(skb);
		iph->frag_off = 0;
		iph->version = 4;
		iph->protocol = IPPROTO_UDP;
		iph->ihl = 0x5;

compile down to read-modify-write instructions. These instructions will read
uninitialized adjacent bits (such as the IPv6 priority field in the
corresponding ipv6 branch) which immediately triggers KMSAN uninit-value
warnings.

Furthermore, fields like iph->tos, iph->ttl, and the UDP checksum remain
completely uninitialized. When this SKB is passed to netdev_get_xmit_slave()
and into __skb_flow_dissect(), a BPF flow dissector attached in the network
namespace could read these uninitialized fields, potentially leaking kernel
memory.

>  
>  	skb->dev = netdev;
>  	skb_reserve(skb, hdr_len);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261015-ib-core-fixes-v1-0-60f6da3ddec3@nvidia.com?part=3