Re: [PATCH] RDMA/rxe: Use validated num_sge in local buffer

[Zhu Yanjun <yanjun.zhu@linux.dev>]

在 2026/9/7 14:44, Nicolas Morey 写道:
> On 2026-09-07 23:20, Zhu Yanjun wrote:
>> 在 2026/9/7 9:15, Nicolas Morey 写道:
>>> For both SRQ and non-SRQ receive paths, the WQE is copied into a local
>>> buffer to provide a kernel-owned, validated copy. While calculating the
>>> memcpy size from the validated num_sge prevents overflow during the
>>> copy, memcpy() itself still copies num_sge from shared memory.
>>>
>>> A concurrent userspace modification before or during memcpy() leaves
>>> an unvalidated num_sge in the local buffer, leading to potential
>>> out-of-bounds reads in rxe_resp_check_length() and copy_data().
>>>
>>
>> Hi Nicolas,
>>
>> Thanks for the patch. The logic makes total sense to prevent the TOCTOU race condition after memcpy.
>>
>> Just out of curiosity, do you happen to have a reproducer or a POC script that demonstrates this race in practice?
>>
>> It would be great to know if this can be reliably reproduced or integrated into testing setups (like rdma-core tests, or tools/testing/selftests/rdma) to catch similar double-read issues in the future.
>>
> 
> No reproducer or PoC sadly. I haven't tried to make one though.
> This got caught by one of our AI tools when checking the backport of CVE-2026-74377.

Hi, Nicolas

Thanks for sharing this. Could you clarify whether your AI tool detected 
this purely through static analysis (and provided a suggested fix), or 
if it actually triggered a runtime bug with a backtrace/calltrace?

If you have a calltrace, please share it—that would help a lot in 
understanding the issue. Also, if this was flagged and fixed by a 
specific AI tool, adding an Assisted-by: tag (or referencing the tool in 
the commit description) would be appropriate.

Thanks,

Zhu Yanjun

> 
> I assumed from the 2 existing fixes (ending up as CVEs) that this could happened.
> 
> Nicolas