Re:Re: [PATCH] RDMA/rxe: Validate inline data range in user WQEs

["jiale yao" <19888972804@163.com>]

At 2026-09-26 01:23:28, "Zhu Yanjun" <yanjun.zhu@linux.dev> wrote:
>在 2026/9/24 3:17, sashiko-bot@kernel.org 写道:
>> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
>> - [Critical] RDMA/rxe: TOCTOU bypass of inline WQE validation
>> --
>> 
>> commit e272f5be8d762ea2e78301c1339c440a19e1130b
>> Author: Jiale Yao <yaojiale02@163.com>
>> 
>> RDMA/rxe: Validate inline data range in user WQEs
>> 
>> This commit adds bounds validation for the inline data range in user WQEs to
>> prevent kernel memory disclosure or vmalloc out-of-bounds accesses. It checks
>> the offset and length against the per-WQE inline area to ensure they fit.
>> 
>> Link: https://lore.kernel.org/all/20260708224534.1206-1-security@auditcode.ai/
>> 
>>> diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c
>>> index 53f7c1e7fe55b..06b7669d7f737 100644
>>> --- a/drivers/infiniband/sw/rxe/rxe_req.c
>>> +++ b/drivers/infiniband/sw/rxe/rxe_req.c
>>> @@ -716,6 +716,15 @@ int rxe_requester(struct rxe_qp *qp)
>>>   		goto err;
>>>   	}
>>>   
>>> +	if (unlikely((wqe->wr.send_flags & IB_SEND_INLINE) &&
>>> +		     (wqe->dma.sge_offset > qp->sq.max_inline ||
>>> +		      wqe->dma.resid >
>>> +		      qp->sq.max_inline - wqe->dma.sge_offset))) {
>> 
>> [Severity: Critical]
>> Since wqe points directly to a memory-mapped ring buffer shared with
>> userspace, can this validation be bypassed via a TOCTOU race?
>> 
>> A malicious userspace program could provide a valid sge_offset here to
>> pass the bounds check, but then concurrently modify wqe->dma.sge_offset
>> in shared memory to an out-of-bounds value.
>> 
>> When finish_packet() executes later on:
>> 
>> finish_packet() {
>>      ...
>>      u8 *tmp = &wqe->dma.inline_data[wqe->dma.sge_offset];
>>      ...
>> }
>> 
>> Could it re-fetch the modified, now out-of-bounds sge_offset directly
>> from shared memory, resulting in the same kernel memory disclosure or
>> vmalloc out-of-bounds access this patch intends to fix?
>
>Hi, Jiale
>
>Please fix the problem that Sashiko mentioned. Then send out a new commit.
>
>Thanks a lot.
>Yanjun Zhu
How about this one,
https://lore.kernel.org/all/20260926070403.3005250-1-yaojiale02@163.com/
>
>> 
>>> +		rxe_dbg_qp(qp, "invalid inline data range in send wqe\n");
>>> +		wqe->status = IB_WC_LOC_QP_OP_ERR;
>>> +		goto err;
>>> +	}
>>> +
>>>   	if (rxe_wqe_is_fenced(qp, wqe)) {
>>>   		qp->req.wait_fence = 1;
>>>   		goto exit;
>>