Re: [PATCH] RDMA/rxe: Validate inline data range in user WQEs

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] RDMA/rxe: TOCTOU bypass of inline WQE validation
--

commit e272f5be8d762ea2e78301c1339c440a19e1130b
Author: Jiale Yao <yaojiale02@163.com>

RDMA/rxe: Validate inline data range in user WQEs

This commit adds bounds validation for the inline data range in user WQEs to
prevent kernel memory disclosure or vmalloc out-of-bounds accesses. It checks
the offset and length against the per-WQE inline area to ensure they fit.

Link: https://lore.kernel.org/all/20260708224534.1206-1-security@auditcode.ai/

> diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c
> index 53f7c1e7fe55b..06b7669d7f737 100644
> --- a/drivers/infiniband/sw/rxe/rxe_req.c
> +++ b/drivers/infiniband/sw/rxe/rxe_req.c
> @@ -716,6 +716,15 @@ int rxe_requester(struct rxe_qp *qp)
>  		goto err;
>  	}
>  
> +	if (unlikely((wqe->wr.send_flags & IB_SEND_INLINE) &&
> +		     (wqe->dma.sge_offset > qp->sq.max_inline ||
> +		      wqe->dma.resid >
> +		      qp->sq.max_inline - wqe->dma.sge_offset))) {

[Severity: Critical]
Since wqe points directly to a memory-mapped ring buffer shared with
userspace, can this validation be bypassed via a TOCTOU race?

A malicious userspace program could provide a valid sge_offset here to
pass the bounds check, but then concurrently modify wqe->dma.sge_offset
in shared memory to an out-of-bounds value.

When finish_packet() executes later on:

finish_packet() {
    ...
    u8 *tmp = &wqe->dma.inline_data[wqe->dma.sge_offset];
    ...
}

Could it re-fetch the modified, now out-of-bounds sge_offset directly
from shared memory, resulting in the same kernel memory disclosure or
vmalloc out-of-bounds access this patch intends to fix?

> +		rxe_dbg_qp(qp, "invalid inline data range in send wqe\n");
> +		wqe->status = IB_WC_LOC_QP_OP_ERR;
> +		goto err;
> +	}
> +
>  	if (rxe_wqe_is_fenced(qp, wqe)) {
>  		qp->req.wait_fence = 1;
>  		goto exit;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260924100515.502912-1-yaojiale02@163.com?part=1