Re: [PATCH v3] RDMA/rxe: Validate inline data range in user WQEs

[sashiko-bot@kernel.org]

> For a user QP, the send queue is an mmap'd ring which userspace writes
> directly.  rxe_post_send() only schedules the send task for such a QP,
> so userspace can also change WQE fields while rxe_requester() processes
> the WQE.
> 
> Commit 126c757e4cd46f866ddc283143b58eb4d9bf52cd ("RDMA/rxe:
> Validate num_sge/cur_sge before indexing wqe->dma.sge[]") added bounds
> checks for two members of the userspace-controlled dma structure, but
> left sge_offset unchecked.  For an inline WQE, finish_packet() uses that
> value directly as an index into inline_data[] and copies dma.resid bytes
> from the resulting pointer into the packet payload.
> 
> A local user with access to uverbs can therefore put an out-of-range
> sge_offset in the mmap'd SQ ring.  This can disclose kernel memory in the
> outgoing packet or cause a vmalloc out-of-bounds access.
> [ ... ]
>    process_scheduled_works+0x7c0/0xf10
> 
> Fixes: 8700e3e7c485 ("Soft RoCE driver")
> Link: https://lore.kernel.org/all/20260708224534.1206-1-security@auditcode.ai/
> Signed-off-by: Jiale Yao <yaojiale02@163.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261004064445.1488753-1-yaojiale02@163.com?part=1