Re: [PATCH] RDMA/rxe: Validate inline data range in user WQEs

[Zhu Yanjun <yanjun.zhu@linux.dev>]

在 2026/9/24 3:17, sashiko-bot@kernel.org 写道:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [Critical] RDMA/rxe: TOCTOU bypass of inline WQE validation
> --
> 
> commit e272f5be8d762ea2e78301c1339c440a19e1130b
> Author: Jiale Yao <yaojiale02@163.com>
> 
> RDMA/rxe: Validate inline data range in user WQEs
> 
> This commit adds bounds validation for the inline data range in user WQEs to
> prevent kernel memory disclosure or vmalloc out-of-bounds accesses. It checks
> the offset and length against the per-WQE inline area to ensure they fit.
> 
> Link: https://lore.kernel.org/all/20260708224534.1206-1-security@auditcode.ai/
> 
>> diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c
>> index 53f7c1e7fe55b..06b7669d7f737 100644
>> --- a/drivers/infiniband/sw/rxe/rxe_req.c
>> +++ b/drivers/infiniband/sw/rxe/rxe_req.c
>> @@ -716,6 +716,15 @@ int rxe_requester(struct rxe_qp *qp)
>>   		goto err;
>>   	}
>>   
>> +	if (unlikely((wqe->wr.send_flags & IB_SEND_INLINE) &&
>> +		     (wqe->dma.sge_offset > qp->sq.max_inline ||
>> +		      wqe->dma.resid >
>> +		      qp->sq.max_inline - wqe->dma.sge_offset))) {
> 
> [Severity: Critical]
> Since wqe points directly to a memory-mapped ring buffer shared with
> userspace, can this validation be bypassed via a TOCTOU race?
> 
> A malicious userspace program could provide a valid sge_offset here to
> pass the bounds check, but then concurrently modify wqe->dma.sge_offset
> in shared memory to an out-of-bounds value.
> 
> When finish_packet() executes later on:
> 
> finish_packet() {
>      ...
>      u8 *tmp = &wqe->dma.inline_data[wqe->dma.sge_offset];
>      ...
> }
> 
> Could it re-fetch the modified, now out-of-bounds sge_offset directly
> from shared memory, resulting in the same kernel memory disclosure or
> vmalloc out-of-bounds access this patch intends to fix?

Hi, Jiale

Please fix the problem that Sashiko mentioned. Then send out a new commit.

Thanks a lot.
Yanjun Zhu

> 
>> +		rxe_dbg_qp(qp, "invalid inline data range in send wqe\n");
>> +		wqe->status = IB_WC_LOC_QP_OP_ERR;
>> +		goto err;
>> +	}
>> +
>>   	if (rxe_wqe_is_fenced(qp, wqe)) {
>>   		qp->req.wait_fence = 1;
>>   		goto exit;
>