From: Li RongQing <lirongqing@baidu.com>

rdma_build_skb() constructs a synthetic IPv6 header for LAG slave
selection and copies the flow label from the AH attribute:

	memcpy(&ip6h->flow_lbl, &ah_attr->grh.flow_label,
	       sizeof(*ip6h->flow_lbl));

ipv6hdr.flow_lbl is __u8[3], so sizeof(*ip6h->flow_lbl) dereferences the
array to a single __u8 and yields 1.  The memcpy therefore copies only
the first byte of the flow label, leaving flow_lbl[1] and flow_lbl[2]
uninitialised in the skb buffer (alloc_skb() does not zero the data).
The resulting LAG hash is computed over one byte of real flow-label
data and two bytes of kmalloc residue, so IPv6 RoCEv2 traffic on a
bonded interface can be steered to the wrong slave.

Use sizeof(ip6h->flow_lbl) (the array, 3 bytes) so the whole flow label
is copied.

Fixes: bd3920eac1331 ("RDMA/core: Add LAG functionality")
Signed-off-by: Li RongQing <lirongqing@baidu.com>
---
 drivers/infiniband/core/lag.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/infiniband/core/lag.c b/drivers/infiniband/core/lag.c
index 00fe241..88aac91 100644
--- a/drivers/infiniband/core/lag.c
+++ b/drivers/infiniband/core/lag.c
@@ -59,7 +59,7 @@ static struct sk_buff *rdma_build_skb(struct net_device *netdev,
 		ip6h->version = 6;
 		ip6h->nexthdr = IPPROTO_UDP;
 		memcpy(&ip6h->flow_lbl, &ah_attr->grh.flow_label,
-		       sizeof(*ip6h->flow_lbl));
+		       sizeof(ip6h->flow_lbl));
 		memcpy(&ip6h->saddr, ah_attr->grh.sgid_attr->gid.raw,
 		       sizeof(struct in6_addr));
 		memcpy(&ip6h->daddr, ah_attr->grh.dgid.raw,
-- 
2.9.4

On Wed, 16 Sep 2026 20:09:26 +0800, lirongqing wrote:
> rdma_build_skb() constructs a synthetic IPv6 header for LAG slave
> selection and copies the flow label from the AH attribute:
> 
> 	memcpy(&ip6h->flow_lbl, &ah_attr->grh.flow_label,
> 	       sizeof(*ip6h->flow_lbl));
> 
> ipv6hdr.flow_lbl is __u8[3], so sizeof(*ip6h->flow_lbl) dereferences the
> array to a single __u8 and yields 1.  The memcpy therefore copies only
> the first byte of the flow label, leaving flow_lbl[1] and flow_lbl[2]
> uninitialised in the skb buffer (alloc_skb() does not zero the data).
> The resulting LAG hash is computed over one byte of real flow-label
> data and two bytes of kmalloc residue, so IPv6 RoCEv2 traffic on a
> bonded interface can be steered to the wrong slave.
> 
> [...]

Applied, thanks!

[1/1] RDMA/core: Fix partial copy of IPv6 flow_lbl in LAG hash skb
      https://git.kernel.org/rdma/rdma/c/b63d21631f8365

Best regards,
-- 
Leon Romanovsky <leon@kernel.org>