[PATCH] RDMA/rxe: reject IB_WR_REG_MR from user QPs in rxe_reg_fast_mr()

[PATCH] RDMA/rxe: reject IB_WR_REG_MR from user QPs in rxe_reg_fast_mr()

[Youngsung Ahn]

IB_WR_REG_MR is documented as kernel-only ("can not be issued by
userspace"), but nothing enforces it.
rxe_wr_opcode_info[IB_WR_REG_MR] sets WR_LOCAL_OP_MASK for IB_QPT_RC,
a QP type userspace can create, so a user QP that writes
opcode = IB_WR_REG_MR into its mmap'd SQ ring reaches
rxe_do_local_ops() -> rxe_reg_fast_mr(). That function then trusts
the ring-supplied fields:

	struct rxe_mr *mr = to_rmr(wqe->wr.wr.reg.mr);
	...
	if (unlikely(mr->state != RXE_MR_STATE_FREE))    /* deref */
	...
	mr->access = access;                             /* write */

For a user QP wqe->wr.wr.reg.mr is a fully attacker-chosen pointer,
so this is an arbitrary-kernel-address dereference (arbitrary read
confirmed, oops). No existing check distinguishes a user QP on this
path.

Reject IB_WR_REG_MR for user QPs before dereferencing the supplied
pointer.

Fixes: 8700e3e7c485 ("Soft RoCE driver")
Signed-off-by: Youngsung Ahn <ays511.kr@gmail.com>
---
Notes (not part of the commit):
Reproduced on 7.3-rc4 as uid 1000 (arbitrary-address read dereference / oops).
Present unchanged in mainline 551c722f4080 (2026-09-29) and rdma for-next;
note that commit 2dac7006b9fb ("RDMA/rxe: Reject IB_ACCESS_ON_DEMAND changes
after MR creation") recently touched this function for the ACCESS_ON_DEMAND
flag but left the pointer dereference in place. Compile-tested (KASAN+RDMA_RXE),
not runtime-tested. Found through manual review; per security-bugs.rst this is
public and a reproducer can be shared on request. The Fixes: tag should be
refined to the commit that added rxe_reg_fast_mr() when preparing for merge.

 drivers/infiniband/sw/rxe/rxe_mr.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/infiniband/sw/rxe/rxe_mr.c b/drivers/infiniband/sw/rxe/rxe_mr.c
index 71d9ea477289..3a914c243829 100644
--- a/drivers/infiniband/sw/rxe/rxe_mr.c
+++ b/drivers/infiniband/sw/rxe/rxe_mr.c
@@ -777,6 +777,10 @@ int rxe_reg_fast_mr(struct rxe_qp *qp, struct rxe_send_wqe *wqe)
 	u32 key = wqe->wr.wr.reg.key;
 	u32 access = wqe->wr.wr.reg.access;

+	/* IB_WR_REG_MR is a kernel-only op; a user QP must not reach here. */
+	if (qp->is_user)
+		return -EOPNOTSUPP;
+
 	/* user can only register MR in free state */
 	if (unlikely(mr->state != RXE_MR_STATE_FREE)) {
 		rxe_dbg_mr(mr, "mr->lkey = 0x%x not free\n", mr->lkey);
--
2.43.0

Re: [PATCH] RDMA/rxe: reject IB_WR_REG_MR from user QPs in rxe_reg_fast_mr()

[sashiko-bot]

> IB_WR_REG_MR is documented as kernel-only ("can not be issued by
> userspace"), but nothing enforces it.
> rxe_wr_opcode_info[IB_WR_REG_MR] sets WR_LOCAL_OP_MASK for IB_QPT_RC,
> a QP type userspace can create, so a user QP that writes
> opcode = IB_WR_REG_MR into its mmap'd SQ ring reaches
> rxe_do_local_ops() -> rxe_reg_fast_mr(). That function then trusts
> the ring-supplied fields:
> 
> 	struct rxe_mr *mr = to_rmr(wqe->wr.wr.reg.mr);
> 	...
> 	if (unlikely(mr->state != RXE_MR_STATE_FREE))    /* deref */
> 	...
> 	mr->access = access;                             /* write */
> 
> For a user QP wqe->wr.wr.reg.mr is a fully attacker-chosen pointer,
> so this is an arbitrary-kernel-address dereference (arbitrary read
> confirmed, oops). No existing check distinguishes a user QP on this
> path.
> 
> Reject IB_WR_REG_MR for user QPs before dereferencing the supplied
> pointer.
> 
> Fixes: 8700e3e7c485 ("Soft RoCE driver")
> Signed-off-by: Youngsung Ahn <ays511.kr@gmail.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260930182126.2510559-1-ays511.kr@gmail.com?part=1

[PATCH v2] RDMA/rxe: reject IB_WR_REG_MR from user QPs in rxe_reg_fast_mr()

[Youngsung Ahn]

IB_WR_REG_MR is documented as kernel-only ("can not be issued by
userspace"), but nothing enforces it.
rxe_wr_opcode_info[IB_WR_REG_MR] sets WR_LOCAL_OP_MASK for IB_QPT_RC,
a QP type userspace can create, so a user QP that writes
opcode = IB_WR_REG_MR into its mmap'd SQ ring reaches
rxe_do_local_ops() -> rxe_reg_fast_mr(). That function then trusts
the ring-supplied fields:

	struct rxe_mr *mr = to_rmr(wqe->wr.wr.reg.mr);
	...
	if (unlikely(mr->state != RXE_MR_STATE_FREE))    /* deref */
	...
	mr->access = access;                             /* write */

For a user QP wqe->wr.wr.reg.mr is a fully attacker-chosen pointer,
so this is an arbitrary-kernel-address dereference (arbitrary read
confirmed, oops). No existing check distinguishes a user QP on this
path.

Reject IB_WR_REG_MR for user QPs before dereferencing the supplied
pointer.

Fixes: 8700e3e7c485 ("Soft RoCE driver")
Cc: stable@vger.kernel.org
Signed-off-by: Youngsung Ahn <ays511.kr@gmail.com>
Assisted-by: LLM
---
Notes (not part of the commit):
Reproduced on 7.3-rc4 as uid 1000 (arbitrary-address read dereference / oops).
Present unchanged in mainline 551c722f4080 (2026-09-29) and rdma for-next;
note that commit 2dac7006b9fb ("RDMA/rxe: Reject IB_ACCESS_ON_DEMAND changes
after MR creation") recently touched this function for the ACCESS_ON_DEMAND
flag but left the pointer dereference in place. Compile-tested (KASAN+RDMA_RXE),
not runtime-tested. Per security-bugs.rst this is public and a reproducer can
be shared on request. The Fixes: tag should be refined to the commit that
added rxe_reg_fast_mr() when preparing for merge.

v2: no code change. Resent as plain text via git send-email; added Cc: stable,
fixed the author/Signed-off-by match, and added Assisted-by: LLM.

 drivers/infiniband/sw/rxe/rxe_mr.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/infiniband/sw/rxe/rxe_mr.c b/drivers/infiniband/sw/rxe/rxe_mr.c
index 71d9ea477289..3a914c243829 100644
--- a/drivers/infiniband/sw/rxe/rxe_mr.c
+++ b/drivers/infiniband/sw/rxe/rxe_mr.c
@@ -777,6 +777,10 @@ int rxe_reg_fast_mr(struct rxe_qp *qp, struct rxe_send_wqe *wqe)
 	u32 key = wqe->wr.wr.reg.key;
 	u32 access = wqe->wr.wr.reg.access;

+	/* IB_WR_REG_MR is a kernel-only op; a user QP must not reach here. */
+	if (qp->is_user)
+		return -EOPNOTSUPP;
+
 	/* user can only register MR in free state */
 	if (unlikely(mr->state != RXE_MR_STATE_FREE)) {
 		rxe_dbg_mr(mr, "mr->lkey = 0x%x not free\n", mr->lkey);
--
2.43.0

Re: [PATCH v2] RDMA/rxe: reject IB_WR_REG_MR from user QPs in rxe_reg_fast_mr()

[sashiko-bot]

> IB_WR_REG_MR is documented as kernel-only ("can not be issued by
> userspace"), but nothing enforces it.
> rxe_wr_opcode_info[IB_WR_REG_MR] sets WR_LOCAL_OP_MASK for IB_QPT_RC,
> a QP type userspace can create, so a user QP that writes
> opcode = IB_WR_REG_MR into its mmap'd SQ ring reaches
> rxe_do_local_ops() -> rxe_reg_fast_mr(). That function then trusts
> the ring-supplied fields:
> 
> 	struct rxe_mr *mr = to_rmr(wqe->wr.wr.reg.mr);
> 	...
> 	if (unlikely(mr->state != RXE_MR_STATE_FREE))    /* deref */
> 	...
> 	mr->access = access;                             /* write */
> 
> For a user QP wqe->wr.wr.reg.mr is a fully attacker-chosen pointer,
> so this is an arbitrary-kernel-address dereference (arbitrary read
> confirmed, oops). No existing check distinguishes a user QP on this
> path.
> 
> Reject IB_WR_REG_MR for user QPs before dereferencing the supplied
> pointer.
> 
> Fixes: 8700e3e7c485 ("Soft RoCE driver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Youngsung Ahn <ays511.kr@gmail.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261001152426.3259522-1-ays511.kr@gmail.com?part=1