[PATCH] RDMA/rxe: bound the WQE opcode before indexing rxe_wr_opcode_info[]

[PATCH] RDMA/rxe: bound the WQE opcode before indexing rxe_wr_opcode_info[]

[AYS]

wr_opcode_mask() indexes the global rxe_wr_opcode_info[] array with a
caller-supplied opcode and no bounds check. For a user QP the WQE comes from
an mmap'd SQ ring, so wqe->wr.opcode is an attacker-controlled __u32 read back
by the requester (req_next_wqe() -> rxe_requester()); rxe_post_send() takes
the qp->is_user branch and never runs validate_send_wr(), whose only opcode
check is itself !wr_opcode_mask() (it indexes before it checks).
rxe_wr_opcode_info[] has entries only up to IB_WR_REG_MR, so an out-of-range
opcode reads out of bounds and the result is used as a mask and dereferenced;
observed as a KASAN global-out-of-bounds "Read of size 4" and a wild-pointer
oops.

Return a zero mask for an out-of-range opcode, matching how validate_send_wr()
already treats a zero mask (an invalid WR), so no path indexes the array out
of bounds.

Fixes: 8700e3e7c485 ("Soft RoCE driver")
Signed-off-by: Youngsung Ahn <ays511.kr@gmail.com>
---
Notes (not part of the commit):
Reproduced on a KASAN x86-64 build of 7.3-rc4 as uid 1000. Present unchanged
in mainline 551c722f4080 (2026-09-29) and rdma for-next. Compile-tested
(KASAN+RDMA_RXE), not runtime-tested. Found through manual review; per
security-bugs.rst this is public and a reproducer can be shared on request.
IB_WR_REG_MR is the highest index the array initializes; an
ARRAY_SIZE(rxe_wr_opcode_info) bound would be equivalent but the array is
extern to this header.

 drivers/infiniband/sw/rxe/rxe_loc.h | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/infiniband/sw/rxe/rxe_loc.h
b/drivers/infiniband/sw/rxe/rxe_loc.h
index 64d636bf80fd..dcc0788db90a 100644
--- a/drivers/infiniband/sw/rxe/rxe_loc.h
+++ b/drivers/infiniband/sw/rxe/rxe_loc.h
@@ -184,6 +184,9 @@ void rxe_comp_queue_pkt(struct rxe_qp *qp, struct
sk_buff *skb);

 static inline unsigned int wr_opcode_mask(int opcode, struct rxe_qp *qp)
 {
+ if (unlikely(opcode < 0 || opcode > IB_WR_REG_MR))
+ return 0;
+
  return rxe_wr_opcode_info[opcode].mask[qp->ibqp.qp_type];
 }

--
2.43.0

Re: [PATCH] RDMA/rxe: bound the WQE opcode before indexing rxe_wr_opcode_info[]

[Greg KH]

On Wed, Sep 30, 2026 at 11:31:08PM +0900, AYS wrote:
> wr_opcode_mask() indexes the global rxe_wr_opcode_info[] array with a
> caller-supplied opcode and no bounds check. For a user QP the WQE comes from
> an mmap'd SQ ring, so wqe->wr.opcode is an attacker-controlled __u32 read back
> by the requester (req_next_wqe() -> rxe_requester()); rxe_post_send() takes
> the qp->is_user branch and never runs validate_send_wr(), whose only opcode
> check is itself !wr_opcode_mask() (it indexes before it checks).
> rxe_wr_opcode_info[] has entries only up to IB_WR_REG_MR, so an out-of-range
> opcode reads out of bounds and the result is used as a mask and dereferenced;
> observed as a KASAN global-out-of-bounds "Read of size 4" and a wild-pointer
> oops.
> 
> Return a zero mask for an out-of-range opcode, matching how validate_send_wr()
> already treats a zero mask (an invalid WR), so no path indexes the array out
> of bounds.
> 
> Fixes: 8700e3e7c485 ("Soft RoCE driver")
> Signed-off-by: Youngsung Ahn <ays511.kr@gmail.com>
> ---
> Notes (not part of the commit):
> Reproduced on a KASAN x86-64 build of 7.3-rc4 as uid 1000. Present unchanged
> in mainline 551c722f4080 (2026-09-29) and rdma for-next. Compile-tested
> (KASAN+RDMA_RXE), not runtime-tested. Found through manual review; per
> security-bugs.rst this is public and a reproducer can be shared on request.
> IB_WR_REG_MR is the highest index the array initializes; an
> ARRAY_SIZE(rxe_wr_opcode_info) bound would be equivalent but the array is
> extern to this header.
> 
>  drivers/infiniband/sw/rxe/rxe_loc.h | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/infiniband/sw/rxe/rxe_loc.h
> b/drivers/infiniband/sw/rxe/rxe_loc.h
> index 64d636bf80fd..dcc0788db90a 100644
> --- a/drivers/infiniband/sw/rxe/rxe_loc.h
> +++ b/drivers/infiniband/sw/rxe/rxe_loc.h
> @@ -184,6 +184,9 @@ void rxe_comp_queue_pkt(struct rxe_qp *qp, struct
> sk_buff *skb);
> 
>  static inline unsigned int wr_opcode_mask(int opcode, struct rxe_qp *qp)
>  {
> + if (unlikely(opcode < 0 || opcode > IB_WR_REG_MR))
> + return 0;
> +
>   return rxe_wr_opcode_info[opcode].mask[qp->ibqp.qp_type];
>  }
> 
> --
> 2.43.0
> 

Patch is corrupted and can not be applied :(

Re: [PATCH] RDMA/rxe: bound the WQE opcode before indexing rxe_wr_opcode_info[]

[Zhu Yanjun]

在 2026/9/30 7:31, AYS 写道:
> wr_opcode_mask() indexes the global rxe_wr_opcode_info[] array with a
> caller-supplied opcode and no bounds check. For a user QP the WQE comes from
> an mmap'd SQ ring, so wqe->wr.opcode is an attacker-controlled __u32 read back
> by the requester (req_next_wqe() -> rxe_requester()); rxe_post_send() takes
> the qp->is_user branch and never runs validate_send_wr(), whose only opcode
> check is itself !wr_opcode_mask() (it indexes before it checks).
> rxe_wr_opcode_info[] has entries only up to IB_WR_REG_MR, so an out-of-range
> opcode reads out of bounds and the result is used as a mask and dereferenced;
> observed as a KASAN global-out-of-bounds "Read of size 4" and a wild-pointer
> oops.
> 
> Return a zero mask for an out-of-range opcode, matching how validate_send_wr()
> already treats a zero mask (an invalid WR), so no path indexes the array out
> of bounds.
> 
> Fixes: 8700e3e7c485 ("Soft RoCE driver")
> Signed-off-by: Youngsung Ahn <ays511.kr@gmail.com>
> ---
> Notes (not part of the commit):
> Reproduced on a KASAN x86-64 build of 7.3-rc4 as uid 1000. Present unchanged
> in mainline 551c722f4080 (2026-09-29) and rdma for-next. Compile-tested
> (KASAN+RDMA_RXE), not runtime-tested. Found through manual review; per
> security-bugs.rst this is public and a reproducer can be shared on request.
> IB_WR_REG_MR is the highest index the array initializes; an
> ARRAY_SIZE(rxe_wr_opcode_info) bound would be equivalent but the array is
> extern to this header.
> 
>   drivers/infiniband/sw/rxe/rxe_loc.h | 3 +++
>   1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/infiniband/sw/rxe/rxe_loc.h
> b/drivers/infiniband/sw/rxe/rxe_loc.h
> index 64d636bf80fd..dcc0788db90a 100644
> --- a/drivers/infiniband/sw/rxe/rxe_loc.h
> +++ b/drivers/infiniband/sw/rxe/rxe_loc.h
> @@ -184,6 +184,9 @@ void rxe_comp_queue_pkt(struct rxe_qp *qp, struct
> sk_buff *skb);
> 
>   static inline unsigned int wr_opcode_mask(int opcode, struct rxe_qp *qp)
>   {
> + if (unlikely(opcode < 0 || opcode > IB_WR_REG_MR))
> + return 0;

Would you like to read coding-style.rst in kernel document, rewrite the 
above code snippet, then resend this commit?
Thanks a lot.

Yanjun Zhu

> +
>    return rxe_wr_opcode_info[opcode].mask[qp->ibqp.qp_type];
>   }
> 
> --
> 2.43.0

[PATCH] RDMA/rxe: bound the WQE opcode before indexing rxe_wr_opcode_info[]

[Youngsung Ahn]

wr_opcode_mask() indexes the global rxe_wr_opcode_info[] array with
a caller-supplied opcode and no bounds check. For a user QP the WQE
comes from an mmap'd SQ ring, so wqe->wr.opcode is an
attacker-controlled __u32 read back by the requester
(req_next_wqe() -> rxe_requester()); rxe_post_send() takes the
qp->is_user branch and never runs validate_send_wr(), whose only
opcode check is itself !wr_opcode_mask() (it indexes before it
checks). rxe_wr_opcode_info[] has entries only up to IB_WR_REG_MR,
so an out-of-range opcode reads out of bounds and the result is used
as a mask and dereferenced; observed as a KASAN global-out-of-bounds
"Read of size 4" and a wild-pointer oops.

Return a zero mask for an out-of-range opcode, matching how
validate_send_wr() already treats a zero mask (an invalid WR), so no
path indexes the array out of bounds.

Fixes: 8700e3e7c485 ("Soft RoCE driver")
Signed-off-by: Youngsung Ahn <ays511.kr@gmail.com>
---
Notes (not part of the commit):
Reproduced on a KASAN x86-64 build of 7.3-rc4 as uid 1000. Present unchanged
in mainline 551c722f4080 (2026-09-29) and rdma for-next. Compile-tested
(KASAN+RDMA_RXE), not runtime-tested. Found through manual review; per
security-bugs.rst this is public and a reproducer can be shared on request.
IB_WR_REG_MR is the highest index the array initializes; an
ARRAY_SIZE(rxe_wr_opcode_info) bound would be equivalent but the array is
extern to this header.

 drivers/infiniband/sw/rxe/rxe_loc.h | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/infiniband/sw/rxe/rxe_loc.h b/drivers/infiniband/sw/rxe/rxe_loc.h
index 64d636bf80fd..dcc0788db90a 100644
--- a/drivers/infiniband/sw/rxe/rxe_loc.h
+++ b/drivers/infiniband/sw/rxe/rxe_loc.h
@@ -184,6 +184,9 @@ void rxe_comp_queue_pkt(struct rxe_qp *qp, struct sk_buff *skb);

 static inline unsigned int wr_opcode_mask(int opcode, struct rxe_qp *qp)
 {
+	if (unlikely(opcode < 0 || opcode > IB_WR_REG_MR))
+		return 0;
+
 	return rxe_wr_opcode_info[opcode].mask[qp->ibqp.qp_type];
 }

--
2.43.0

Re: [PATCH] RDMA/rxe: bound the WQE opcode before indexing rxe_wr_opcode_info[]

[sashiko-bot]

> wr_opcode_mask() indexes the global rxe_wr_opcode_info[] array with
> a caller-supplied opcode and no bounds check. For a user QP the WQE
> comes from an mmap'd SQ ring, so wqe->wr.opcode is an
> attacker-controlled __u32 read back by the requester
> (req_next_wqe() -> rxe_requester()); rxe_post_send() takes the
> qp->is_user branch and never runs validate_send_wr(), whose only
> opcode check is itself !wr_opcode_mask() (it indexes before it
> checks). rxe_wr_opcode_info[] has entries only up to IB_WR_REG_MR,
> so an out-of-range opcode reads out of bounds and the result is used
> as a mask and dereferenced; observed as a KASAN global-out-of-bounds
> "Read of size 4" and a wild-pointer oops.
> 
> Return a zero mask for an out-of-range opcode, matching how
> validate_send_wr() already treats a zero mask (an invalid WR), so no
> path indexes the array out of bounds.
> 
> Fixes: 8700e3e7c485 ("Soft RoCE driver")
> Signed-off-by: Youngsung Ahn <ays511.kr@gmail.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260930180221.2497908-1-ays511.kr@gmail.com?part=1