Re: [PATCH net] RDS/IB: validate receive completion payload length

[Allison Henderson <achender@kernel.org>]

On Wed, 2026-10-07 at 05:52 +0900, sungbyeongchan wrote:
> An RDS/RDMA peer can declare a fragment length larger than the payload
> reported by the receive completion. The receive path attaches the recycled
> receive fragment without validating those lengths, allowing recvmsg() to
> return stale bytes beyond the actual payload.
> 
> Validate data_len against the expected current-fragment length before
> transferring fragment ownership. Disconnect and reconnect on mismatch.
> 
> The issue reproduced in two clean QEMU boots. A peer declared 4096 bytes
> while posting only 16 bytes, and a receiver under a different UID obtained
> 4080-byte tails from prior messages in all 256 attempts in each boot. With
> this change, the malformed message was not delivered, reconnection
> succeeded, and a subsequent normal 4096-byte message was delivered intact.
> 
> Fixes: 1e23b3ee0e94 ("RDS/IB: Receive datagrams via IB")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: sungbyeongchan <tjdqudcks0424@naver.com>

Hi Sungbyeongchan,

Thanks for sending this, and for following up on the earlier feedback so
quickly.  However, I realized after I sent it that another contributor had
already publicly sent an equivalent fix earlier today, and the convention is
to take the first correct patch on the list.
https://lore.kernel.org/netdev/20261006125720.81227-1-shubham@octane.security/

So no need to follow up with the sashiko review, and I apologize for the
miss-communication, but I will ask your Reported-by tag to be applied since you
were the first to report the same bug. This was a solid find, and the reproduction
was very well done. Please continue to send RDS fixes as you find them.

Thank you!
Allison

> ---
>  net/rds/ib_recv.c | 9 +++++++++
>  1 file changed, 9 insertions(+)
> 
> diff --git a/net/rds/ib_recv.c b/net/rds/ib_recv.c
> index bd6cb3ffaa571..0daddb108c8a7 100644
> --- a/net/rds/ib_recv.c
> +++ b/net/rds/ib_recv.c
> @@ -949,6 +949,15 @@ static void rds_ib_process_recv(struct rds_connection *conn,
>  		}
>  	}
>  
> +	if (data_len != min_t(u32, ic->i_recv_data_rem, RDS_FRAG_SIZE)) {
> +		rds_ib_conn_error(conn,
> +				  "incoming fragment payload length %u, expected %u; "
> +				  "disconnecting and reconnecting\n",
> +				  data_len,
> +				  min_t(u32, ic->i_recv_data_rem, RDS_FRAG_SIZE));
> +		goto done;
> +	}
> +
>  	list_add_tail(&recv->r_frag->f_item, &ibinc->ii_frags);
>  	recv->r_frag = NULL;
>