[PATCH] RDMA/rxe: Reject prefetch of a non-ODP MR

[PATCH] RDMA/rxe: Reject prefetch of a non-ODP MR

[Norbert Szetei]

rxe_ib_advise_mr_prefetch() and rxe_ib_prefetch_sg_list() look up the MR
by lkey and hand it to rxe_odp_do_pagefault_and_lock() without checking
that it is an ODP MR. That path runs to_ib_umem_odp() on mr->umem, and
for a non-ODP MR mr->umem is a plain struct ib_umem from ib_umem_get(),
so the container_of() in to_ib_umem_odp() lands past the end of the
object and ib_umem_odp_map_dma_and_lock() reads its ib_umem_odp fields
out of bounds.

lookup_mr() validates the lkey, PD, access and state but not the MR
type, and IB_UVERBS_ADVISE_MR_ADVICE_PREFETCH is accepted for any MR.

  BUG: KASAN: slab-out-of-bounds in ib_umem_odp_map_dma_and_lock+0x884/0x8a0
  Read of size 8 at addr ffff88810a3ebcf0 by task advi/921
   ib_umem_odp_map_dma_and_lock+0x884/0x8a0
   rxe_ib_advise_mr+0x543/0xad0
   ib_uverbs_handler_UVERBS_METHOD_ADVISE_MR+0x446/0x530
   ib_uverbs_cmd_verbs+0x2b3c/0x3b20
   ib_uverbs_ioctl+0x1e3/0x310
  Allocated by task 921:
   __ib_umem_get_va+0x13e/0xae0
   rxe_mr_init_user+0x2ae/0xb00
   rxe_reg_user_mr+0x337/0x510
  The buggy address belongs to the object at ffff88810a3ebc80
   which belongs to the cache kmalloc-96 of size 96

Reject a non-ODP MR after lookup_mr() in both the synchronous and
asynchronous prefetch arms.

Fixes: 3576b0df1588 ("RDMA/rxe: Implement synchronous prefetch for ODP MRs")
Cc: stable@vger.kernel.org
Signed-off-by: Norbert Szetei <norbert@doyensec.com>
---
 drivers/infiniband/sw/rxe/rxe_odp.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/drivers/infiniband/sw/rxe/rxe_odp.c b/drivers/infiniband/sw/rxe/rxe_odp.c
index e870efa7a0a3..5c9dde3501a0 100644
--- a/drivers/infiniband/sw/rxe/rxe_odp.c
+++ b/drivers/infiniband/sw/rxe/rxe_odp.c
@@ -472,6 +472,11 @@ static int rxe_ib_prefetch_sg_list(struct ib_pd *ibpd,
 			return -EINVAL;
 		}
 
+		if (unlikely(!is_odp_mr(mr))) {
+			rxe_put(mr);
+			return -EOPNOTSUPP;
+		}
+
 		if (advice == IB_UVERBS_ADVISE_MR_ADVICE_PREFETCH_WRITE &&
 		    !mr->umem->writable) {
 			rxe_dbg_mr(mr, "missing write permission\n");
@@ -536,6 +541,12 @@ static int rxe_ib_advise_mr_prefetch(struct ib_pd *ibpd,
 			goto err;
 		}
 
+		if (unlikely(!is_odp_mr(mr))) {
+			rxe_put(mr);
+			mr = ERR_PTR(-EOPNOTSUPP);
+			goto err;
+		}
+
 		work->frags[i].io_virt = sg_list[i].addr;
 		work->frags[i].length = sg_list[i].length;
 		work->frags[i].mr = mr;
-- 
2.55.0

Re: [PATCH] RDMA/rxe: Reject prefetch of a non-ODP MR

[Zhu Yanjun]

在 2026/8/27 3:51, Norbert Szetei 写道:
> rxe_ib_advise_mr_prefetch() and rxe_ib_prefetch_sg_list() look up the MR
> by lkey and hand it to rxe_odp_do_pagefault_and_lock() without checking
> that it is an ODP MR. That path runs to_ib_umem_odp() on mr->umem, and
> for a non-ODP MR mr->umem is a plain struct ib_umem from ib_umem_get(),
> so the container_of() in to_ib_umem_odp() lands past the end of the
> object and ib_umem_odp_map_dma_and_lock() reads its ib_umem_odp fields
> out of bounds.
> 
> lookup_mr() validates the lkey, PD, access and state but not the MR
> type, and IB_UVERBS_ADVISE_MR_ADVICE_PREFETCH is accepted for any MR.
> 
>    BUG: KASAN: slab-out-of-bounds in ib_umem_odp_map_dma_and_lock+0x884/0x8a0
>    Read of size 8 at addr ffff88810a3ebcf0 by task advi/921
>     ib_umem_odp_map_dma_and_lock+0x884/0x8a0
>     rxe_ib_advise_mr+0x543/0xad0
>     ib_uverbs_handler_UVERBS_METHOD_ADVISE_MR+0x446/0x530
>     ib_uverbs_cmd_verbs+0x2b3c/0x3b20
>     ib_uverbs_ioctl+0x1e3/0x310
>    Allocated by task 921:
>     __ib_umem_get_va+0x13e/0xae0
>     rxe_mr_init_user+0x2ae/0xb00
>     rxe_reg_user_mr+0x337/0x510
>    The buggy address belongs to the object at ffff88810a3ebc80
>     which belongs to the cache kmalloc-96 of size 96
> 
> Reject a non-ODP MR after lookup_mr() in both the synchronous and
> asynchronous prefetch arms.
> 
> Fixes: 3576b0df1588 ("RDMA/rxe: Implement synchronous prefetch for ODP MRs")
> Cc: stable@vger.kernel.org
> Signed-off-by: Norbert Szetei <norbert@doyensec.com>
> ---
>   drivers/infiniband/sw/rxe/rxe_odp.c | 11 +++++++++++
>   1 file changed, 11 insertions(+)
> 
> diff --git a/drivers/infiniband/sw/rxe/rxe_odp.c b/drivers/infiniband/sw/rxe/rxe_odp.c
> index e870efa7a0a3..5c9dde3501a0 100644
> --- a/drivers/infiniband/sw/rxe/rxe_odp.c
> +++ b/drivers/infiniband/sw/rxe/rxe_odp.c
> @@ -472,6 +472,11 @@ static int rxe_ib_prefetch_sg_list(struct ib_pd *ibpd,
>   			return -EINVAL;
>   		}
>   
> +		if (unlikely(!is_odp_mr(mr))) {

lookup_mr is a function specific to rxe. Renaming it to rxe_lookup_mr 
would make this clearer.

When I first saw this function, I assumed it was a generic RDMA 
function. After looking into the implementation, I realized that it is 
specific to rxe. Therefore, I think rxe_lookup_mr would be a clearer and 
more descriptive name.

Anyway, I think this commit is fine. Thanks a lot.

Reviewed-by: Zhu Yanjun yanjun.zhu@linux.dev

Zhu Yanjun > +			rxe_put(mr);
> +			return -EOPNOTSUPP;
> +		}
> +
>   		if (advice == IB_UVERBS_ADVISE_MR_ADVICE_PREFETCH_WRITE &&
>   		    !mr->umem->writable) {
>   			rxe_dbg_mr(mr, "missing write permission\n");
> @@ -536,6 +541,12 @@ static int rxe_ib_advise_mr_prefetch(struct ib_pd *ibpd,
>   			goto err;
>   		}
>   
> +		if (unlikely(!is_odp_mr(mr))) {
> +			rxe_put(mr);
> +			mr = ERR_PTR(-EOPNOTSUPP);
> +			goto err;
> +		}
> +
>   		work->frags[i].io_virt = sg_list[i].addr;
>   		work->frags[i].length = sg_list[i].length;
>   		work->frags[i].mr = mr;

Re: [PATCH] RDMA/rxe: Reject prefetch of a non-ODP MR

[Leon Romanovsky]

On Thu, Aug 27, 2026 at 12:51:20PM +0200, Norbert Szetei wrote:
> rxe_ib_advise_mr_prefetch() and rxe_ib_prefetch_sg_list() look up the MR
> by lkey and hand it to rxe_odp_do_pagefault_and_lock() without checking
> that it is an ODP MR. That path runs to_ib_umem_odp() on mr->umem, and
> for a non-ODP MR mr->umem is a plain struct ib_umem from ib_umem_get(),
> so the container_of() in to_ib_umem_odp() lands past the end of the
> object and ib_umem_odp_map_dma_and_lock() reads its ib_umem_odp fields
> out of bounds.
> 
> lookup_mr() validates the lkey, PD, access and state but not the MR
> type, and IB_UVERBS_ADVISE_MR_ADVICE_PREFETCH is accepted for any MR.
> 
>   BUG: KASAN: slab-out-of-bounds in ib_umem_odp_map_dma_and_lock+0x884/0x8a0
>   Read of size 8 at addr ffff88810a3ebcf0 by task advi/921
>    ib_umem_odp_map_dma_and_lock+0x884/0x8a0
>    rxe_ib_advise_mr+0x543/0xad0
>    ib_uverbs_handler_UVERBS_METHOD_ADVISE_MR+0x446/0x530
>    ib_uverbs_cmd_verbs+0x2b3c/0x3b20
>    ib_uverbs_ioctl+0x1e3/0x310
>   Allocated by task 921:
>    __ib_umem_get_va+0x13e/0xae0
>    rxe_mr_init_user+0x2ae/0xb00
>    rxe_reg_user_mr+0x337/0x510
>   The buggy address belongs to the object at ffff88810a3ebc80
>    which belongs to the cache kmalloc-96 of size 96
> 
> Reject a non-ODP MR after lookup_mr() in both the synchronous and
> asynchronous prefetch arms.
> 
> Fixes: 3576b0df1588 ("RDMA/rxe: Implement synchronous prefetch for ODP MRs")
> Cc: stable@vger.kernel.org
> Signed-off-by: Norbert Szetei <norbert@doyensec.com>
> ---
>  drivers/infiniband/sw/rxe/rxe_odp.c | 11 +++++++++++
>  1 file changed, 11 insertions(+)
> 
> diff --git a/drivers/infiniband/sw/rxe/rxe_odp.c b/drivers/infiniband/sw/rxe/rxe_odp.c
> index e870efa7a0a3..5c9dde3501a0 100644
> --- a/drivers/infiniband/sw/rxe/rxe_odp.c
> +++ b/drivers/infiniband/sw/rxe/rxe_odp.c
> @@ -472,6 +472,11 @@ static int rxe_ib_prefetch_sg_list(struct ib_pd *ibpd,
>  			return -EINVAL;
>  		}
>  
> +		if (unlikely(!is_odp_mr(mr))) {
> +			rxe_put(mr);
> +			return -EOPNOTSUPP;
> +		}

The idea is correct, but the implementation needs some improvement.

RXE stores the access flags in the MR, including IB_ACCESS_ON_DEMAND,
which indicates that the MR was created as an ODP MR. lookup_mr()
should check this flag and perform the lookup accordingly.

Thanks.

Re: [PATCH] RDMA/rxe: Reject prefetch of a non-ODP MR

[Norbert Szetei]

On Sep 1, 2026, at 09:56, Leon Romanovsky <leon@kernel.org> wrote:
> 
> On Thu, Aug 27, 2026 at 12:51:20PM +0200, Norbert Szetei wrote:
>> rxe_ib_advise_mr_prefetch() and rxe_ib_prefetch_sg_list() look up the MR
>> by lkey and hand it to rxe_odp_do_pagefault_and_lock() without checking
>> that it is an ODP MR. That path runs to_ib_umem_odp() on mr->umem, and
>> for a non-ODP MR mr->umem is a plain struct ib_umem from ib_umem_get(),
>> so the container_of() in to_ib_umem_odp() lands past the end of the
>> object and ib_umem_odp_map_dma_and_lock() reads its ib_umem_odp fields
>> out of bounds.
>> 
>> lookup_mr() validates the lkey, PD, access and state but not the MR
>> type, and IB_UVERBS_ADVISE_MR_ADVICE_PREFETCH is accepted for any MR.
>> 
>>  BUG: KASAN: slab-out-of-bounds in ib_umem_odp_map_dma_and_lock+0x884/0x8a0
>>  Read of size 8 at addr ffff88810a3ebcf0 by task advi/921
>>   ib_umem_odp_map_dma_and_lock+0x884/0x8a0
>>   rxe_ib_advise_mr+0x543/0xad0
>>   ib_uverbs_handler_UVERBS_METHOD_ADVISE_MR+0x446/0x530
>>   ib_uverbs_cmd_verbs+0x2b3c/0x3b20
>>   ib_uverbs_ioctl+0x1e3/0x310
>>  Allocated by task 921:
>>   __ib_umem_get_va+0x13e/0xae0
>>   rxe_mr_init_user+0x2ae/0xb00
>>   rxe_reg_user_mr+0x337/0x510
>>  The buggy address belongs to the object at ffff88810a3ebc80
>>   which belongs to the cache kmalloc-96 of size 96
>> 
>> Reject a non-ODP MR after lookup_mr() in both the synchronous and
>> asynchronous prefetch arms.
>> 
>> Fixes: 3576b0df1588 ("RDMA/rxe: Implement synchronous prefetch for ODP MRs")
>> Cc: stable@vger.kernel.org
>> Signed-off-by: Norbert Szetei <norbert@doyensec.com>
>> ---
>> drivers/infiniband/sw/rxe/rxe_odp.c | 11 +++++++++++
>> 1 file changed, 11 insertions(+)
>> 
>> diff --git a/drivers/infiniband/sw/rxe/rxe_odp.c b/drivers/infiniband/sw/rxe/rxe_odp.c
>> index e870efa7a0a3..5c9dde3501a0 100644
>> --- a/drivers/infiniband/sw/rxe/rxe_odp.c
>> +++ b/drivers/infiniband/sw/rxe/rxe_odp.c
>> @@ -472,6 +472,11 @@ static int rxe_ib_prefetch_sg_list(struct ib_pd *ibpd,
>> return -EINVAL;
>> }
>> 
>> + if (unlikely(!is_odp_mr(mr))) {
>> + rxe_put(mr);
>> + return -EOPNOTSUPP;
>> + }
> 
> The idea is correct, but the implementation needs some improvement.
> 
> RXE stores the access flags in the MR, including IB_ACCESS_ON_DEMAND,
> which indicates that the MR was created as an ODP MR. lookup_mr()
> should check this flag and perform the lookup accordingly.

Do you mean lookup_mr() should take IB_ACCESS_ON_DEMAND into account, so that
the existing (access & mr->access) != access test rejects the non-ODP MR?

rxe_rereg_user_mr() with IB_MR_REREG_ACCESS assigns mr->access directly, and
IB_ACCESS_ON_DEMAND is part of RXE_ACCESS_SUPPORTED_MR. So userspace can set
that flag on a plain MR after registration, without the umem changing. Am I
missing something there? 

Thanks.

> 
> Thanks.