Re: [PATCH net-next v2] net: rds: check cmsg_len before reading rds_rdma_args in size pass

[Allison Henderson <achender@kernel.org>]

On Tue, 2026-06-16 at 22:31 -0400, Michael Bommarito wrote:
> rds_rm_size() handles RDS_CMSG_RDMA_ARGS after only CMSG_OK() and then
> calls rds_rdma_extra_size(), which reads args->local_vec_addr and
> args->nr_local without first checking that cmsg_len covers struct
> rds_rdma_args. The other two RDS_CMSG_RDMA_ARGS consumers already guard
> this: rds_rdma_bytes() in rds_sendmsg() and rds_cmsg_rdma_args() in
> rds_cmsg_send() both reject cmsg_len < CMSG_LEN(sizeof(struct
> rds_rdma_args)). Add the same check to rds_rm_size() so all three RDMA
> args passes are consistent.
> 
> This is a consistency and hardening change with no behavioral effect for
> well-formed senders and no reachable bug today: rds_rdma_bytes() runs
> before rds_rm_size() in rds_sendmsg() and already rejects a short
> RDS_CMSG_RDMA_ARGS, so the size pass is not reached with an undersized
> cmsg. But rds_rm_size() reads the args independently of that earlier
> pass, and nothing in rds_rm_size() itself records or enforces the
> precondition, so a reader or a future refactor of the size pass cannot
> tell the cmsg has already been length-checked. Applying the same
> cmsg_len guard in all three RDS_CMSG_RDMA_ARGS consumers keeps that
> invariant local to each and robust to reordering.
> 
> Assisted-by: Claude:claude-opus-4-8
> Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
This looks good to me.  Thanks for working on this.

Reviewed-by: Allison Henderson <achender@kernel.org>
Allison

> ---
> v2:
>  - Re-target net-next and drop the Fixes: tag and the stable Cc. This
>    is a consistency/hardening change, not a reachable bug: as Allison
>    Henderson noted, rds_rdma_bytes() runs before rds_rm_size() in
>    rds_sendmsg() and already rejects a short RDS_CMSG_RDMA_ARGS, so a
>    user cannot reach the rds_rm_size() read through sendmsg.
>  - Corrected the changelog: the two sibling guards are rds_rdma_bytes()
>    in rds_sendmsg() and rds_cmsg_rdma_args() in rds_cmsg_send(); the
>    former runs before, not after, rds_rm_size().
>  - Dropped the KASAN/AF_RDS reachability framing. No code change from v1.
>  - v1: https://lore.kernel.org/all/20260614130725.2520842-1-michael.bommarito@gmail.com/
> 
>  net/rds/send.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/net/rds/send.c b/net/rds/send.c
> index d8b14ff9d366b..6ca3192b1d8af 100644
> --- a/net/rds/send.c
> +++ b/net/rds/send.c
> @@ -967,6 +967,8 @@ static int rds_rm_size(struct msghdr *msg, int num_sgs,
>  
>  		switch (cmsg->cmsg_type) {
>  		case RDS_CMSG_RDMA_ARGS:
> +			if (cmsg->cmsg_len < CMSG_LEN(sizeof(struct rds_rdma_args)))
> +				return -EINVAL;
>  			if (vct->indx >= vct->len) {
>  				vct->len += vct->incr;
>  				tmp_iov =
> 
> base-commit: 5200f5f493f79f14bbdc349e402a40dfb32f23c8