Re: [PATCH] RDMA/core: Fix partial copy of IPv6 flow_lbl in LAG hash skb

[Leon Romanovsky]

On Wed, 16 Sep 2026 20:09:26 +0800, lirongqing wrote:
> rdma_build_skb() constructs a synthetic IPv6 header for LAG slave
> selection and copies the flow label from the AH attribute:
> 
> 	memcpy(&ip6h->flow_lbl, &ah_attr->grh.flow_label,
> 	       sizeof(*ip6h->flow_lbl));
> 
> ipv6hdr.flow_lbl is __u8[3], so sizeof(*ip6h->flow_lbl) dereferences the
> array to a single __u8 and yields 1.  The memcpy therefore copies only
> the first byte of the flow label, leaving flow_lbl[1] and flow_lbl[2]
> uninitialised in the skb buffer (alloc_skb() does not zero the data).
> The resulting LAG hash is computed over one byte of real flow-label
> data and two bytes of kmalloc residue, so IPv6 RoCEv2 traffic on a
> bonded interface can be steered to the wrong slave.
> 
> [...]

Applied, thanks!

[1/1] RDMA/core: Fix partial copy of IPv6 flow_lbl in LAG hash skb
      https://git.kernel.org/rdma/rdma/c/b63d21631f8365

Best regards,
-- 
Leon Romanovsky <leon@xxxxxxxxxx>