Re: [PATCH] RDMA/rxe: validate inline sge_offset in finish_packet() before indexing inline_data[]

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] rdma/rxe: TOCTOU bypass of sge_offset bounds check in finish_packet()
--

commit cb139c29341b6f7fcb85c3b737c416392d13b68f
Author: Youngsung Ahn <ays511.kr@gmail.com>
Subject: RDMA/rxe: validate inline sge_offset in finish_packet() before indexing inline_data[]

This commit aims to fix an out-of-bounds read by bounding sge_offset against
qp->sq.max_inline before copying inline data from the mmap'd send queue.

> diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c
> index 53f7c1e7fe55b..887bceed6b5d1 100644
> --- a/drivers/infiniband/sw/rxe/rxe_req.c
> +++ b/drivers/infiniband/sw/rxe/rxe_req.c
> @@ -510,7 +510,14 @@ static int finish_packet(struct rxe_qp *qp, struct rxe_av *av,
>  
>  	if (pkt->mask & RXE_WRITE_OR_SEND_MASK) {
>  		if (wqe->wr.send_flags & IB_SEND_INLINE) {
> -			u8 *tmp = &wqe->dma.inline_data[wqe->dma.sge_offset];
> +			u8 *tmp;
> +
> +			if (unlikely(wqe->dma.sge_offset > (u32)qp->sq.max_inline ||
> +				     payload > (u32)qp->sq.max_inline -
> +					       wqe->dma.sge_offset))
> +				return -EINVAL;

[Severity: High]
Since the send queue is mapped into user space, can a concurrent modification
to wqe->dma.sge_offset bypass this check?

It looks like the value is read multiple times directly from shared memory.
Could an attacker swap a valid offset with an invalid one immediately after
the bounds check succeeds?

> +
> +			tmp = &wqe->dma.inline_data[wqe->dma.sge_offset];

[Severity: High]
Does this setup an out-of-bounds pointer for the subsequent memcpy if
wqe->dma.sge_offset is modified after the validation above?

Would caching wqe->dma.sge_offset in a local variable via READ_ONCE()
prevent this race?

>  
>  			memcpy(payload_addr(pkt), tmp, payload);
>

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260930182216.2510953-1-ays511.kr@gmail.com?part=1