[PATCH] RDMA/rxe: validate inline sge_offset in finish_packet() before indexing inline_data[]

[PATCH] RDMA/rxe: validate inline sge_offset in finish_packet() before indexing inline_data[]

[Youngsung Ahn]

For a user QP, rxe_post_send() takes the qp->is_user branch and
never runs init_send_wqe(), so
dma.length/resid/num_sge/cur_sge/sge_offset all come straight from
the mmap'd SQ ring. In the inline send path finish_packet() uses
sge_offset directly as an index:

	u8 *tmp = &wqe->dma.inline_data[wqe->dma.sge_offset];
	memcpy(payload_addr(pkt), tmp, payload);

inline_data is a flex array whose capacity is qp->sq.max_inline, but
sge_offset is a u32 from user space, so the source pointer is
displaced arbitrarily past the WQE and the memcpy reads out of
bounds.
commit 126c757e4cd4 ("RDMA/rxe: Validate num_sge/cur_sge before indexing wqe->dma.sge[]")
added num_sge/cur_sge checks on the send path but not sge_offset, the
third attacker-controlled index in the same struct.

Bound sge_offset (and the payload that follows it) by
qp->sq.max_inline before the copy.

Fixes: 8700e3e7c485 ("Soft RoCE driver")
Signed-off-by: Youngsung Ahn <ays511.kr@gmail.com>
---
Notes (not part of the commit):
Reproduced on 7.3-rc4 as uid 1000: "BUG: unable to handle page fault ...
memcpy+0xc/0x30" from rxe_requester, 4/4. Present unchanged in mainline
551c722f4080 (2026-09-29) and rdma for-next. Compile-tested (KASAN+RDMA_RXE),
not runtime-tested. Found through manual review; per security-bugs.rst this is
public and a reproducer can be shared on request.

 drivers/infiniband/sw/rxe/rxe_req.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c
index 24f5c044363f..06e24d818075 100644
--- a/drivers/infiniband/sw/rxe/rxe_req.c
+++ b/drivers/infiniband/sw/rxe/rxe_req.c
@@ -510,7 +510,14 @@ static int finish_packet(struct rxe_qp *qp, struct rxe_av *av,

 	if (pkt->mask & RXE_WRITE_OR_SEND_MASK) {
 		if (wqe->wr.send_flags & IB_SEND_INLINE) {
-			u8 *tmp = &wqe->dma.inline_data[wqe->dma.sge_offset];
+			u8 *tmp;
+
+			if (unlikely(wqe->dma.sge_offset > (u32)qp->sq.max_inline ||
+				     payload > (u32)qp->sq.max_inline -
+					       wqe->dma.sge_offset))
+				return -EINVAL;
+
+			tmp = &wqe->dma.inline_data[wqe->dma.sge_offset];

 			memcpy(payload_addr(pkt), tmp, payload);

--
2.43.0

Re: [PATCH] RDMA/rxe: validate inline sge_offset in finish_packet() before indexing inline_data[]

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] rdma/rxe: TOCTOU bypass of sge_offset bounds check in finish_packet()
--

commit cb139c29341b6f7fcb85c3b737c416392d13b68f
Author: Youngsung Ahn <ays511.kr@gmail.com>
Subject: RDMA/rxe: validate inline sge_offset in finish_packet() before indexing inline_data[]

This commit aims to fix an out-of-bounds read by bounding sge_offset against
qp->sq.max_inline before copying inline data from the mmap'd send queue.

> diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c
> index 53f7c1e7fe55b..887bceed6b5d1 100644
> --- a/drivers/infiniband/sw/rxe/rxe_req.c
> +++ b/drivers/infiniband/sw/rxe/rxe_req.c
> @@ -510,7 +510,14 @@ static int finish_packet(struct rxe_qp *qp, struct rxe_av *av,
>  
>  	if (pkt->mask & RXE_WRITE_OR_SEND_MASK) {
>  		if (wqe->wr.send_flags & IB_SEND_INLINE) {
> -			u8 *tmp = &wqe->dma.inline_data[wqe->dma.sge_offset];
> +			u8 *tmp;
> +
> +			if (unlikely(wqe->dma.sge_offset > (u32)qp->sq.max_inline ||
> +				     payload > (u32)qp->sq.max_inline -
> +					       wqe->dma.sge_offset))
> +				return -EINVAL;

[Severity: High]
Since the send queue is mapped into user space, can a concurrent modification
to wqe->dma.sge_offset bypass this check?

It looks like the value is read multiple times directly from shared memory.
Could an attacker swap a valid offset with an invalid one immediately after
the bounds check succeeds?

> +
> +			tmp = &wqe->dma.inline_data[wqe->dma.sge_offset];

[Severity: High]
Does this setup an out-of-bounds pointer for the subsequent memcpy if
wqe->dma.sge_offset is modified after the validation above?

Would caching wqe->dma.sge_offset in a local variable via READ_ONCE()
prevent this race?

>  
>  			memcpy(payload_addr(pkt), tmp, payload);
>

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260930182216.2510953-1-ays511.kr@gmail.com?part=1

[PATCH v2] RDMA/rxe: validate inline sge_offset in finish_packet() before indexing inline_data[]

[Youngsung Ahn]

For a user QP, rxe_post_send() takes the qp->is_user branch and
never runs init_send_wqe(), so
dma.length/resid/num_sge/cur_sge/sge_offset all come straight from
the mmap'd SQ ring. In the inline send path finish_packet() uses
sge_offset directly as an index:

	u8 *tmp = &wqe->dma.inline_data[wqe->dma.sge_offset];
	memcpy(payload_addr(pkt), tmp, payload);

inline_data is a flex array whose capacity is qp->sq.max_inline, but
sge_offset is a u32 from user space, so the source pointer is
displaced arbitrarily past the WQE and the memcpy reads out of
bounds.
commit 126c757e4cd4 ("RDMA/rxe: Validate num_sge/cur_sge before indexing wqe->dma.sge[]")
added num_sge/cur_sge checks on the send path but not sge_offset, the
third attacker-controlled index in the same struct.

Read sge_offset once with READ_ONCE() and bound it (and the payload
that follows it) by qp->sq.max_inline before indexing, so the value
that is validated is the value that is used.

Fixes: 8700e3e7c485 ("Soft RoCE driver")
Cc: stable@vger.kernel.org
Signed-off-by: Youngsung Ahn <ays511.kr@gmail.com>
Assisted-by: LLM
---
Notes (not part of the commit):
Reproduced on 7.3-rc4 as uid 1000: "BUG: unable to handle page fault ...
memcpy+0xc/0x30" from rxe_requester, 4/4. Present unchanged in mainline
551c722f4080 (2026-09-29) and rdma for-next. Compile-tested (KASAN+RDMA_RXE),
not runtime-tested. Found through manual review; per security-bugs.rst this is
public and a reproducer can be shared on request.

v2: the WQE lives in the mmap'd ring, so read dma.sge_offset once with
READ_ONCE() into a local and validate/index that local, closing the TOCTOU
noted in automated review (v1 re-read the field after the bounds check).
Dropped security@kernel.org Cc.

 drivers/infiniband/sw/rxe/rxe_req.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c
index 24f5c044363f..06e24d818075 100644
--- a/drivers/infiniband/sw/rxe/rxe_req.c
+++ b/drivers/infiniband/sw/rxe/rxe_req.c
@@ -510,7 +510,14 @@ static int finish_packet(struct rxe_qp *qp, struct rxe_av *av,

 	if (pkt->mask & RXE_WRITE_OR_SEND_MASK) {
 		if (wqe->wr.send_flags & IB_SEND_INLINE) {
-			u8 *tmp = &wqe->dma.inline_data[wqe->dma.sge_offset];
+			u32 sge_offset = READ_ONCE(wqe->dma.sge_offset);
+			u8 *tmp;
+
+			if (unlikely(sge_offset > (u32)qp->sq.max_inline ||
+				     payload > (u32)qp->sq.max_inline - sge_offset))
+				return -EINVAL;
+
+			tmp = &wqe->dma.inline_data[sge_offset];

 			memcpy(payload_addr(pkt), tmp, payload);

--
2.43.0

Re: [PATCH v2] RDMA/rxe: validate inline sge_offset in finish_packet() before indexing inline_data[]

[sashiko-bot]

> For a user QP, rxe_post_send() takes the qp->is_user branch and
> never runs init_send_wqe(), so
> dma.length/resid/num_sge/cur_sge/sge_offset all come straight from
> the mmap'd SQ ring. In the inline send path finish_packet() uses
> sge_offset directly as an index:
> 
> 	u8 *tmp = &wqe->dma.inline_data[wqe->dma.sge_offset];
> 	memcpy(payload_addr(pkt), tmp, payload);
> 
> inline_data is a flex array whose capacity is qp->sq.max_inline, but
> sge_offset is a u32 from user space, so the source pointer is
> displaced arbitrarily past the WQE and the memcpy reads out of
> bounds.
> commit 126c757e4cd4 ("RDMA/rxe: Validate num_sge/cur_sge before indexing wqe->dma.sge[]")
> added num_sge/cur_sge checks on the send path but not sge_offset, the
> third attacker-controlled index in the same struct.
> 
> Read sge_offset once with READ_ONCE() and bound it (and the payload
> that follows it) by qp->sq.max_inline before indexing, so the value
> that is validated is the value that is used.
> 
> Fixes: 8700e3e7c485 ("Soft RoCE driver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Youngsung Ahn <ays511.kr@gmail.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261001152433.3259573-1-ays511.kr@gmail.com?part=1

Re: [PATCH v2] RDMA/rxe: validate inline sge_offset in finish_packet() before indexing inline_data[]

[Leon Romanovsky]

On Fri, Oct 02, 2026 at 12:24:33AM +0900, Youngsung Ahn wrote:
> For a user QP, rxe_post_send() takes the qp->is_user branch and
> never runs init_send_wqe(), so
> dma.length/resid/num_sge/cur_sge/sge_offset all come straight from
> the mmap'd SQ ring. In the inline send path finish_packet() uses
> sge_offset directly as an index:
> 
> 	u8 *tmp = &wqe->dma.inline_data[wqe->dma.sge_offset];
> 	memcpy(payload_addr(pkt), tmp, payload);
> 
> inline_data is a flex array whose capacity is qp->sq.max_inline, but
> sge_offset is a u32 from user space, so the source pointer is
> displaced arbitrarily past the WQE and the memcpy reads out of
> bounds.
> commit 126c757e4cd4 ("RDMA/rxe: Validate num_sge/cur_sge before indexing wqe->dma.sge[]")
> added num_sge/cur_sge checks on the send path but not sge_offset, the
> third attacker-controlled index in the same struct.
> 
> Read sge_offset once with READ_ONCE() and bound it (and the payload
> that follows it) by qp->sq.max_inline before indexing, so the value
> that is validated is the value that is used.
> 
> Fixes: 8700e3e7c485 ("Soft RoCE driver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Youngsung Ahn <ays511.kr@gmail.com>
> Assisted-by: LLM
> ---
> Notes (not part of the commit):
> Reproduced on 7.3-rc4 as uid 1000: "BUG: unable to handle page fault ...
> memcpy+0xc/0x30" from rxe_requester, 4/4. Present unchanged in mainline
> 551c722f4080 (2026-09-29) and rdma for-next. Compile-tested (KASAN+RDMA_RXE),
> not runtime-tested. Found through manual review; per security-bugs.rst this is
> public and a reproducer can be shared on request.
> 
> v2: the WQE lives in the mmap'd ring, so read dma.sge_offset once with
> READ_ONCE() into a local and validate/index that local, closing the TOCTOU
> noted in automated review (v1 re-read the field after the bounds check).
> Dropped security@kernel.org Cc.
> 
>  drivers/infiniband/sw/rxe/rxe_req.c | 9 ++++++++-
>  1 file changed, 8 insertions(+), 1 deletion(-)

Please do not send patches as replies to previous versions. Send them as
standalone messages.

Thanks

[PATCH] RDMA/rxe: validate inline sge_offset in finish_packet() before indexing inline_data[]

[AYS]

For a user QP, rxe_post_send() takes the qp->is_user branch and never runs
init_send_wqe(), so dma.length/resid/num_sge/cur_sge/sge_offset all come
straight from the mmap'd SQ ring. In the inline send path finish_packet()
uses sge_offset directly as an index:

u8 *tmp = &wqe->dma.inline_data[wqe->dma.sge_offset];
memcpy(payload_addr(pkt), tmp, payload);

inline_data is a flex array whose capacity is qp->sq.max_inline, but
sge_offset is a u32 from user space, so the source pointer is displaced
arbitrarily past the WQE and the memcpy reads out of bounds. Commit
126c757e4cd4 added num_sge/cur_sge checks on the send path but not sge_offset,
the third attacker-controlled index in the same struct.

Bound sge_offset (and the payload that follows it) by qp->sq.max_inline before
the copy.

Fixes: 8700e3e7c485 ("Soft RoCE driver")
Signed-off-by: Youngsung Ahn <ays511.kr@gmail.com>
---
Notes (not part of the commit):
Reproduced on 7.3-rc4 as uid 1000: "BUG: unable to handle page fault ...
memcpy+0xc/0x30" from rxe_requester, 4/4. Present unchanged in mainline
551c722f4080 (2026-09-29) and rdma for-next. Compile-tested (KASAN+RDMA_RXE),
not runtime-tested. Found through manual review; per security-bugs.rst this is
public and a reproducer can be shared on request.

 drivers/infiniband/sw/rxe/rxe_req.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/infiniband/sw/rxe/rxe_req.c
b/drivers/infiniband/sw/rxe/rxe_req.c
index 24f5c044363f..06e24d818075 100644
--- a/drivers/infiniband/sw/rxe/rxe_req.c
+++ b/drivers/infiniband/sw/rxe/rxe_req.c
@@ -510,7 +510,14 @@ static int finish_packet(struct rxe_qp *qp,
struct rxe_av *av,

  if (pkt->mask & RXE_WRITE_OR_SEND_MASK) {
  if (wqe->wr.send_flags & IB_SEND_INLINE) {
- u8 *tmp = &wqe->dma.inline_data[wqe->dma.sge_offset];
+ u8 *tmp;
+
+ if (unlikely(wqe->dma.sge_offset > (u32)qp->sq.max_inline ||
+     payload > (u32)qp->sq.max_inline -
+       wqe->dma.sge_offset))
+ return -EINVAL;
+
+ tmp = &wqe->dma.inline_data[wqe->dma.sge_offset];

  memcpy(payload_addr(pkt), tmp, payload);

--
2.43.0