Re: [PATCH net] RDS/IB: validate receive completion payload length
flat view
From: Allison Henderson <achender@kernel.org>
Date: 2026-10-07 01:13:18
Also in:
linux-rdma, lkml
On Wed, 2026-10-07 at 05:52 +0900, sungbyeongchan wrote:
An RDS/RDMA peer can declare a fragment length larger than the payload
reported by the receive completion. The receive path attaches the recycled
receive fragment without validating those lengths, allowing recvmsg() to
return stale bytes beyond the actual payload.
Validate data_len against the expected current-fragment length before
transferring fragment ownership. Disconnect and reconnect on mismatch.
The issue reproduced in two clean QEMU boots. A peer declared 4096 bytes
while posting only 16 bytes, and a receiver under a different UID obtained
4080-byte tails from prior messages in all 256 attempts in each boot. With
this change, the malformed message was not delivered, reconnection
succeeded, and a subsequent normal 4096-byte message was delivered intact.
Fixes: 1e23b3ee0e94 ("RDS/IB: Receive datagrams via IB")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: sungbyeongchan <redacted>Hi Sungbyeongchan, Thanks for sending this, and for following up on the earlier feedback so quickly. However, I realized after I sent it that another contributor had already publicly sent an equivalent fix earlier today, and the convention is to take the first correct patch on the list. https://lore.kernel.org/netdev/20261006125720.81227-1-shubham@octane.security/ (local) So no need to follow up with the sashiko review, and I apologize for the miss-communication, but I will ask your Reported-by tag to be applied since you were the first to report the same bug. This was a solid find, and the reproduction was very well done. Please continue to send RDS fixes as you find them. Thank you! Allison
quoted hunk ↗ jump to hunk
--- net/rds/ib_recv.c | 9 +++++++++ 1 file changed, 9 insertions(+)diff --git a/net/rds/ib_recv.c b/net/rds/ib_recv.c index bd6cb3ffaa571..0daddb108c8a7 100644 --- a/net/rds/ib_recv.c +++ b/net/rds/ib_recv.c@@ -949,6 +949,15 @@ static void rds_ib_process_recv(struct rds_connection *conn, } } + if (data_len != min_t(u32, ic->i_recv_data_rem, RDS_FRAG_SIZE)) { + rds_ib_conn_error(conn, + "incoming fragment payload length %u, expected %u; " + "disconnecting and reconnecting\n", + data_len, + min_t(u32, ic->i_recv_data_rem, RDS_FRAG_SIZE)); + goto done; + } + list_add_tail(&recv->r_frag->f_item, &ibinc->ii_frags); recv->r_frag = NULL;