Re: [PATCH v2] RDMA/rxe: reject IB_WR_REG_MR from user QPs in rxe_reg_fast_mr()

[sashiko-bot@kernel.org]

> IB_WR_REG_MR is documented as kernel-only ("can not be issued by
> userspace"), but nothing enforces it.
> rxe_wr_opcode_info[IB_WR_REG_MR] sets WR_LOCAL_OP_MASK for IB_QPT_RC,
> a QP type userspace can create, so a user QP that writes
> opcode = IB_WR_REG_MR into its mmap'd SQ ring reaches
> rxe_do_local_ops() -> rxe_reg_fast_mr(). That function then trusts
> the ring-supplied fields:
> 
> 	struct rxe_mr *mr = to_rmr(wqe->wr.wr.reg.mr);
> 	...
> 	if (unlikely(mr->state != RXE_MR_STATE_FREE))    /* deref */
> 	...
> 	mr->access = access;                             /* write */
> 
> For a user QP wqe->wr.wr.reg.mr is a fully attacker-chosen pointer,
> so this is an arbitrary-kernel-address dereference (arbitrary read
> confirmed, oops). No existing check distinguishes a user QP on this
> path.
> 
> Reject IB_WR_REG_MR for user QPs before dereferencing the supplied
> pointer.
> 
> Fixes: 8700e3e7c485 ("Soft RoCE driver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Youngsung Ahn <ays511.kr@gmail.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261001152426.3259522-1-ays511.kr@gmail.com?part=1