[PATCH v2] RDMA/rxe: validate cur_sge on the receive path before indexing dma->sge[]

[Youngsung Ahn <ays511.kr@gmail.com>]

A user QP's receive queue is an mmap'd ring: the user provider
writes the WQEs and post_recv does not touch them, so every field of
struct rxe_recv_wqe is attacker controlled. When the responder takes
a WQE it validates only dma.num_sge (rxe_get_recv_wqe() /
get_srq_wqe()); dma.cur_sge, dma.sge_offset and dma.resid are copied
into qp->resp.srq_wqe unchecked.

copy_data() then uses cur_sge as an index immediately --
	struct rxe_sge *sge = &dma->sge[dma->cur_sge];
-- and dereferences it (sge->length) before the in-loop
"dma->cur_sge >= dma->num_sge" test, which only runs after the first
sge++. cur_sge is a u32, so this reads far out of bounds of the
RXE_MAX_SGE-entry dma->sge[] embedded in the kmalloc-2k struct
rxe_qp: an information leak (the out-of-bounds sge->length is
recoverable through the work-completion status) and a DoS. The send
queue already got this check in
commit 126c757e4cd4 ("RDMA/rxe: Validate num_sge/cur_sge before indexing wqe->dma.sge[]");
the receive path did not.

Reject an out-of-range cur_sge in copy_data() before the first sge
dereference. This also covers the send retry path and is harmless to
the kernel ULP path, which always sets cur_sge = 0.

Fixes: 8700e3e7c485 ("Soft RoCE driver")
Cc: stable@vger.kernel.org
Signed-off-by: Youngsung Ahn <ays511.kr@gmail.com>
Assisted-by: LLM
---
Notes (not part of the commit):
Reproduced on a KASAN x86-64 build of 7.3-rc4 as uid 1000 (uverbs0 is 0666
after a one-time "rdma link add"), cross-checked via the CQE-status bit
oracle. Present unchanged in mainline 551c722f4080 (2026-09-29) and rdma
for-next. Compile-tested (KASAN+RDMA_RXE), not runtime-tested. Per
security-bugs.rst this is public and a reproducer can be shared on request.
The responder works on the kernel-side copy in qp->resp.srq_wqe, so there is
no TOCTOU on cur_sge here.

v2: no code change. Fixed the author/Signed-off-by mismatch (v1 went out via
Gmail with the display name "AYS"), resent as plain text via git send-email,
and added Cc: stable@vger.kernel.org and Assisted-by: LLM per Greg KH's review.

 drivers/infiniband/sw/rxe/rxe_mr.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/infiniband/sw/rxe/rxe_mr.c b/drivers/infiniband/sw/rxe/rxe_mr.c
index 71d9ea477289..b9aff32fffad 100644
--- a/drivers/infiniband/sw/rxe/rxe_mr.c
+++ b/drivers/infiniband/sw/rxe/rxe_mr.c
@@ -437,6 +437,11 @@ int copy_data(
 		goto err2;
 	}

+	if (unlikely(dma->cur_sge >= dma->num_sge)) {
+		err = -EINVAL;
+		goto err2;
+	}
+
 	if (sge->length && (offset < sge->length)) {
 		mr = lookup_mr(pd, access, sge->lkey, RXE_LOOKUP_LOCAL);
 		if (!mr) {
--
2.43.0