Re: [PATCH v3] RDMA/rxe: validate cur_sge on the receive path before indexing dma->sge[]

[sashiko-bot@kernel.org]

> A user QP's receive queue is an mmap'd ring. The user provider writes
> the WQEs into it and post_recv never touches them, so every field of
> struct rxe_recv_wqe comes from user space. When the responder picks up a
> WQE it only checks dma.num_sge (in rxe_get_recv_wqe() and
> get_srq_wqe()). dma.cur_sge, dma.sge_offset and dma.resid are copied
> into qp->resp.srq_wqe without any check.
> 
> copy_data() then uses cur_sge as an index right away:
> 
> 	struct rxe_sge *sge = &dma->sge[dma->cur_sge];
> 
> It dereferences that pointer (sge->length) before the in-loop
> "dma->cur_sge >= dma->num_sge" test, which only runs after the first
> sge++. cur_sge is a u32, so the pointer can land far outside
> dma->sge[], which has RXE_MAX_SGE entries and sits inside the
> [ ... ]
> retransmit path reaches dma->sge[] through advance_dma_data(), which
> still has the same unchecked index. I will send those separately.
> 
> Fixes: 8700e3e7c485 ("Soft RoCE driver")
> Signed-off-by: Youngsung Ahn <ays511.kr@gmail.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261004153325.2952372-1-ays511.kr@gmail.com?part=1