Re: [PATCH v9 2/2] RDMA/rxe: copy send WQE to kernel buffer in completer path

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] RDMA/rxe: comp_wqe_valid cleared in rxe_requester() before struct definition
--

commit fe57a6fbeb3985861e302c45b7aad80d47e4ce81
Author: Tristan Madani <tristmd@gmail.com>

RDMA/rxe: copy send WQE to kernel buffer in completer path

This commit copies the send WQE from the userspace-mapped shared queue into a
completer-private buffer in get_wqe() to prevent TOCTOU races, validates the
opcode and SGE bounds, and writes back DMA progress and completion status to
shared memory.

[ ... ]

> diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.h b/drivers/infiniband/sw/rxe/rxe_verbs.h
> index 0fc6c69f4f840..ddc195c283326 100644
> --- a/drivers/infiniband/sw/rxe/rxe_verbs.h
> +++ b/drivers/infiniband/sw/rxe/rxe_verbs.h
> @@ -130,6 +130,12 @@ struct rxe_comp_info {
>  	int			started_retry;
>  	u32			retry_cnt;
>  	u32			rnr_retry;
> +	struct rxe_send_wqe	*shared_wqe;
> +	bool			comp_wqe_valid;
> +	struct {
> +		struct rxe_send_wqe	wqe;
> +		struct ib_sge		sge[RXE_MAX_SGE];
> +	} comp_wqe;
>  };

[Severity: Low]
Does the previous patch in the series ("RDMA/rxe: copy send WQE to kernel
buffer before processing") fail to build on its own because it references
qp->comp.comp_wqe_valid before comp_wqe_valid is added to struct rxe_comp_info
here?

In that first patch, rxe_requester() in drivers/infiniband/sw/rxe/rxe_req.c
adds:

	if (unlikely(qp->req.need_retry && !qp->req.wait_for_rnr_timer)) {
		req_retry(qp);
		qp->req.need_retry = 0;
		qp->req.send_wqe_valid = false;
		qp->comp.comp_wqe_valid = false;
	}

Should the qp->comp.comp_wqe_valid = false assignment in rxe_requester() be
moved into this commit so that each patch in the series compiles cleanly
during a git bisect?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261030183409.195671-1-tristan@talencesecurity.com?part=2