Re: [PATCH net v7 3/4] net/smc: bound the send length to the send buffer in smc_tx_sendmsg()

[Bryam Vargas <hexlabsecurity@proton.me>]

On Thu, 15 Oct 2026 20:15:22 +0000, netdev-bot+sashiko@kernel.org wrote:
> [Severity: High]
> Mapping a negative writespace to sndbuf_desc->len is new behaviour from
> this patch. It turns a negative sndbuf_space into a full-ring copy on
> every pass of the loop. Is that intended?

It is, for what can reach it. With 4/4 in, sndbuf_space goes negative
only through the DMB-merge credit, which runs on the loopback device
alone, IOW only the local kernel can forge it, and it takes 2^31/len
forged CDCs (measured); without 4/4 a forged cursor at failover does it
in one step, which is 4/4's case. The SMC-R over-credit after a failover
is positive (3x the buffer in the measured case), a "<= 0" gate wouldn't
see it, and the clamp is what keeps that copy inside the buffer. A gate
that blocks the sender at <= 0 is a fair alternative for the loopback
case, but it is four sites and its own change, so v8 keeps the code. The
comment in smc_tx_sendmsg() that claims 0 <= sndbuf_space <= len is
corrected in v8; the three "guarantee" comments in the credit paths from
your Low item describe the conforming case and stay.

> [Severity: High]
> This is a pre-existing issue, and this patch didn't introduce it. The
> clamp limits the size of each copy but doesn't fix the flow control.

Right: after the over-credit the copy stays in the buffer but can
overwrite data the peer has not received yet. Fixing the credit needs a
cursor compare that survives the u16 wrap rollover, which
smc_curs_comp() doesn't give; not in this series.

> [Severity: High]
> This is also a pre-existing issue. What serializes smc_switch_cursor()
> against smc_cdc_tx_handler()?

Nothing beyond what you list, send_lock on one side and bh_lock_sock()
on the other. The interleaving you give credits the handler's bytes a
second time and leaves tx_curs_fin ahead of tx_curs_sent, and a later
completion moves tx_curs_fin back and credits again. Pre-existing,
conforming peer, failover with CDC sends in flight.