Re: [PATCH v3] RDMA/rxe: bound the ODP page index against the umem in rxe_check_pagefault()

[sashiko-bot@kernel.org]

> An ODP MR has a page array, map.pfn_list[]. Its size is computed from
> the umem start address. But rxe_check_pagefault() builds the index into
> that array from an iova that is relative to the same start, while the
> access itself was range-checked against the MR's iova (ibmr.iova).
> 
> Those two bases do not have to match. reg_mr only requires that start
> and hca_va have the same page offset, so a user can register an MR with
> hca_va = start + N*PAGE. The difference then becomes an index skew of
> (hca_va - start) >> PAGE_SHIFT. Nothing compares the result with the
> size of pfn_list[], so the read goes past the end of the array.
> 
> An unprivileged local user can reach this with a single RDMA operation
> on a self-connected rxe QP. KASAN reports a slab-out-of-bounds read. If
> the out-of-bounds qword happens to look like a writable HMM pfn, rxe
> then copies the payload into a page the user never registered.
> 
> Reject an index that falls outside the umem and take the fault path
> instead. That path rejects the out-of-range access in
> ib_umem_odp_map_dma_and_lock(), which does check the umem range. The
> other users of pfn_list[], __rxe_odp_mr_copy() and the atomic helpers,
> run only after a successful map, so this single check covers them too.
> 
> Fixes: 2fae67ab63db ("RDMA/rxe: Add support for Send/Recv/Write/Read with ODP")
> Signed-off-by: Youngsung Ahn <ays511.kr@gmail.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261004153246.2951263-1-ays511.kr@gmail.com?part=1