Re: [PATCH 0/2] RDMA/rxe: fix shared memory TOCTOU in receive path

[Jason Gunthorpe <jgg@nvidia.com>]

On Mon, May 18, 2026 at 09:50:38PM +0000, Tristan Madani wrote:
> RXE queue buffers are mapped read-write into userspace. The receive
> path reads WQE fields from these shared buffers, which lets a
> concurrent userspace thread modify them between validation and use.
> 
> Patch 1 fixes a heap overflow in the SRQ path where num_sge is
> validated but then re-read for the memcpy size calculation.
> 
> Patch 2 addresses the non-SRQ path by copying the WQE to a
> kernel-local buffer before processing, preventing TOCTOU on
> fields used in check_length and copy_data.
> 
> Tristan Madani (2):
>   RDMA/rxe: fix TOCTOU heap overflow in get_srq_wqe
>   RDMA/rxe: copy WQE to local buffer in non-SRQ receive path
> 
>  drivers/infiniband/sw/rxe/rxe_resp.c | 33 ++++++++++++++++++++++++---
>  1 file changed, 28 insertions(+), 5 deletions(-)

Applied to for-next, I added the rxe_ Zhu pointed out

Jason