Re: [PATCH v2 1/2] RDMA/rxe: Reject IB_ACCESS_ON_DEMAND changes after MR creation

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Critical] Arbitrary Kernel Pointer Dereference / Local Privilege Escalation via IB_WR_REG_MR WQE
--

commit fa8758be337c701491b43023c09167d84e64fdc0
Author: Norbert Szetei <norbert@doyensec.com>

RDMA/rxe: Reject IB_ACCESS_ON_DEMAND changes after MR creation

This commit prevents userspace from setting or clearing the
IB_ACCESS_ON_DEMAND flag on memory regions after they are created. This
ensures that the access flag correctly matches the underlying capabilities
of the memory region.

> diff --git a/drivers/infiniband/sw/rxe/rxe_mr.c b/drivers/infiniband/sw/rxe/rxe_mr.c
> index 71d9ea4772890..615da4bb9a38c 100644
> --- a/drivers/infiniband/sw/rxe/rxe_mr.c
> +++ b/drivers/infiniband/sw/rxe/rxe_mr.c
> @@ -796,6 +796,12 @@ int rxe_reg_fast_mr(struct rxe_qp *qp, struct rxe_send_wqe *wqe)
>  		return -EINVAL;
>  	}
>  
> +	/* an MR with no umem is never an ODP MR */
> +	if (unlikely(access & IB_ACCESS_ON_DEMAND)) {
> +		rxe_dbg_mr(mr, "access = 0x%x requests ODP\n", access);
> +		return -EINVAL;
> +	}
> +

[Severity: Critical]
This is a pre-existing issue, but does writing to mr here allow an arbitrary
kernel memory overwrite?

If an unprivileged local user creates a Reliable Connection Queue Pair and
memory-maps its send queue ring buffer, they can write a crafted WQE with
IB_WR_REG_MR and set wqe->wr.wr.reg.mr to an arbitrary kernel pointer.

The kernel processes this WQE in rxe_requester(), which routes the WQE to
kernel-only local operations without verifying if the Queue Pair belongs to
a privileged context:

rxe_req.c:rxe_requester() {
    ...
    if (wqe->mask & WR_LOCAL_OP_MASK) {
        err = rxe_do_local_ops(qp, wqe);
    ...
}

Since rxe_wr_opcode_info allows WR_LOCAL_OP_MASK for IB_WR_REG_MR,
rxe_do_local_ops() dispatches it to rxe_reg_fast_mr().

In rxe_reg_fast_mr(), the arbitrary pointer from the user is directly cast:

rxe_mr.c:rxe_reg_fast_mr() {
    struct rxe_mr *mr = to_rmr(wqe->wr.wr.reg.mr);
    ...
}

Could this cause the subsequent assignments to mr->access, mr->lkey,
mr->rkey, and mr->state to overwrite arbitrary kernel memory?

>  	mr->access = access;
>  	mr->lkey = key;
>  	mr->rkey = key;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260913-rxe-advise-mr-v2-v2-0-b806c789871c@doyensec.com?part=1