Re: [PATCH v4 0/2] RDMA/rxe: fix TOCTOU races in send WQE processing

[Zhu Yanjun <yanjun.zhu@linux.dev>]

在 2026/10/8 5:01, Tristan Madani 写道:
> Hi Yanjun,
>
> Thanks for flagging the Sashiko review. I went through all 8 findings
> across both patches.
>
> One was a genuine issue: the memcpy size used qp->sq.max_sge * sizeof(sge),
> which truncates when max_inline_data is not a multiple of sizeof(struct
> ib_sge). For example, if a QP is created with max_inline_data=20, the
> integer division gives max_sge=1, and only 16 bytes of the flex array are
> copied instead of 20. v5 fixes this by using qp->sq.max_inline directly,
> which is the exact data portion size stored at QP creation.
>
> The remaining 7 seem to be false positives:
>
>    - FORTIFY_SOURCE (raised on both patches): struct rxe_send_wqe ends
>      with struct rxe_dma_info which contains __DECLARE_FLEX_ARRAY, so
>      __builtin_object_size returns (size_t)-1. The merged receive-path
>      fix (d6ab440240a04) uses the same pattern without issues.
>
>    - Inline data / sge_offset / resid / cur_sge validation: these fields
>      were already unvalidated against max_inline before this series. The
>      requester path bounds-checks num_sge and cur_sge (lines 754-760 in
>      rxe_req.c); adding resid/sge_offset validation is a valid hardening
>      improvement, but it is a pre-existing gap, not introduced here.
>
>    - wr_opcode_mask() OOB via untrusted opcode: the call existed at the
>      same location before this series. We did not add it.
>
>    - DMA state writeback for RDMA READ retry: on retry, the requester
>      changes the WQE state via smp_store_release(). The completer's
>      smp_load_acquire() detects the change, bypasses the reuse path, and
>      takes a fresh copy from shared memory with the original DMA offsets.
>
>    - ERR flush path barriers: when send_wqe_valid is false, writes go
>      directly to shared memory, which is identical to the pre-patch
>      behavior.
>
>    - Shared pointer for wqe_state_posted: posted WQEs cause the
>      completer to return COMPST_DONE/COMPST_EXIT without processing.
>
> v5 is already sent with the max_inline fix:
>    https://lore.kernel.org/linux-rdma/20261008093740.3034881-1-tristmd@gmail.com/

Thanks a lot. I checked the V5 patchset, and Sashiko is still 
complaining about quite a few things. I’m not sure whether the latest 
complaints from Sashiko are different from the previous ones or if they 
are essentially the same issues.

BTW, the V5 patchset is not a standalone patchset. Maybe there is 
something wrong with the way the patchset was sent out.

The following steps can be used to generate and send the latest patchset 
as a standalone patchset:

1. git format-patch -2 -n -s -o ./tmp --cover-letter -v 6
This command generates the patchset, including the cover letter, in the 
`./tmp` directory.

2. git send-email --to linux-rdma@vger.kernel.org --to xxx --to xxx ... 
./tmp/*
This command sends all the patches in ./tmp/ as a standalone patchset.

Thanks,

Yanjun Zhu

>
> Best,
> Tristan

-- 
Best Regards,
Yanjun.Zhu