Re: [PATCH 0/2] RDMA/rxe: fix shared memory TOCTOU in receive path

[Zhu Yanjun <yanjun.zhu@linux.dev>]

在 2026/5/18 14:50, Tristan Madani 写道:
> RXE queue buffers are mapped read-write into userspace. The receive
> path reads WQE fields from these shared buffers, which lets a
> concurrent userspace thread modify them between validation and use.

To be honest, can you implement the above? If yes, please show us the 
steps to reproduce this problem.

Thanks a lot.
Zhu Yanjun

> 
> Patch 1 fixes a heap overflow in the SRQ path where num_sge is
> validated but then re-read for the memcpy size calculation.
> 
> Patch 2 addresses the non-SRQ path by copying the WQE to a
> kernel-local buffer before processing, preventing TOCTOU on
> fields used in check_length and copy_data.
> 
> Tristan Madani (2):
>    RDMA/rxe: fix TOCTOU heap overflow in get_srq_wqe
>    RDMA/rxe: copy WQE to local buffer in non-SRQ receive path
> 
>   drivers/infiniband/sw/rxe/rxe_resp.c | 33 ++++++++++++++++++++++++---
>   1 file changed, 28 insertions(+), 5 deletions(-)
>