Re: [PATCH v2] RDMA/rxe: validate cur_sge on the receive path before indexing dma->sge[]

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] RDMA/rxe: double-fetch TOCTOU vulnerability in copy_data() bounds check
--

commit 2fd3d60fe5490f46cfcd1b0614c53c62687fc767
Author: Youngsung Ahn <ays511.kr@gmail.com>

RDMA/rxe: validate cur_sge on the receive path before indexing dma->sge[]

This commit adds bounds validation for cur_sge in copy_data() on the receive
path before the scatter/gather array is accessed. It intends to reject an
out-of-range cur_sge to prevent denial of service or information leaks.

> diff --git a/drivers/infiniband/sw/rxe/rxe_mr.c b/drivers/infiniband/sw/rxe/rxe_mr.c
> index 2afda5154dfb9..0c510bb7ae2a7 100644
> --- a/drivers/infiniband/sw/rxe/rxe_mr.c
> +++ b/drivers/infiniband/sw/rxe/rxe_mr.c
> @@ -436,6 +436,11 @@ int copy_data(
>  		goto err2;
>  	}
>  
> +	if (unlikely(dma->cur_sge >= dma->num_sge)) {

[Severity: High]
Since dma can point directly into an attacker-controlled mmap'd ring buffer,
could this introduce a double-fetch vulnerability?

For example, on the send path, a WQE is retrieved without a kernel copy and
passed along:

rxe_requester()
   finish_packet()
       copy_data(..., &wqe->dma, ...)

Earlier in copy_data(), sge is initialized by fetching dma->cur_sge:

	struct rxe_sge *sge = &dma->sge[dma->cur_sge];

Because the check added here lacks READ_ONCE(), the compiler could fetch
dma->cur_sge twice from shared memory.

A malicious thread might race to provide an out-of-bounds value for the first
fetch, followed by a valid value for this second fetch. This would bypass the
check and result in an out-of-bounds dereference when sge->length is evaluated
shortly after.

Would caching dma->cur_sge locally with READ_ONCE() prevent this?

> +		err = -EINVAL;
> +		goto err2;
> +	}
> +
>  	if (sge->length && (offset < sge->length)) {

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261001152345.3259024-1-ays511.kr@gmail.com?part=1