Re: [PATCH] svcrdma: silently discard undersized messages

[sashiko-bot@kernel.org]

> RFC 8166 requires an RPC-over-RDMA message shorter than the 28-byte
> minimum header to be silently discarded because its XID cannot be
> trusted.
> 
> svc_rdma_xdr_decode_req() instead returns -EINVAL when the fixed header
> cannot be decoded. svc_rdma_recvfrom() turns that into an RDMA_ERROR,
> whose encoder copies the first two words from rc_recv_buf without
> checking rc_byte_len. A zero- to seven-byte SEND can therefore return
> up to eight bytes that were not supplied by the peer.
> 
> Check the complete minimum header length before parsing and use the
> decoder's existing silent-drop return for undersized input. This keeps
> the error encoder from reading beyond the received message and follows
> the protocol requirement.
> 
> [ ... ]
> 
> Fixes: f3ea53fb3bc3 ("svcrdma: Use correct XID in error replies")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Hyunsol Mun <muumthf@gmail.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261022034629.430954-1-muumthf@gmail.com?part=1