Re: [PATCH v4 0/2] RDMA/rxe: fix TOCTOU races in send WQE processing

[Tristan Madani <tristmd@gmail.com>]

Hi Yanjun,

Thanks for flagging the Sashiko review. I went through all 8 findings
across both patches.

One was a genuine issue: the memcpy size used qp->sq.max_sge * sizeof(sge),
which truncates when max_inline_data is not a multiple of sizeof(struct
ib_sge). For example, if a QP is created with max_inline_data=20, the
integer division gives max_sge=1, and only 16 bytes of the flex array are
copied instead of 20. v5 fixes this by using qp->sq.max_inline directly,
which is the exact data portion size stored at QP creation.

The remaining 7 seem to be false positives:

  - FORTIFY_SOURCE (raised on both patches): struct rxe_send_wqe ends
    with struct rxe_dma_info which contains __DECLARE_FLEX_ARRAY, so
    __builtin_object_size returns (size_t)-1. The merged receive-path
    fix (d6ab440240a04) uses the same pattern without issues.

  - Inline data / sge_offset / resid / cur_sge validation: these fields
    were already unvalidated against max_inline before this series. The
    requester path bounds-checks num_sge and cur_sge (lines 754-760 in
    rxe_req.c); adding resid/sge_offset validation is a valid hardening
    improvement, but it is a pre-existing gap, not introduced here.

  - wr_opcode_mask() OOB via untrusted opcode: the call existed at the
    same location before this series. We did not add it.

  - DMA state writeback for RDMA READ retry: on retry, the requester
    changes the WQE state via smp_store_release(). The completer's
    smp_load_acquire() detects the change, bypasses the reuse path, and
    takes a fresh copy from shared memory with the original DMA offsets.

  - ERR flush path barriers: when send_wqe_valid is false, writes go
    directly to shared memory, which is identical to the pre-patch
    behavior.

  - Shared pointer for wqe_state_posted: posted WQEs cause the
    completer to return COMPST_DONE/COMPST_EXIT without processing.

v5 is already sent with the max_inline fix:
  https://lore.kernel.org/linux-rdma/20261008093740.3034881-1-tristmd@gmail.com/

Best,
Tristan