[PATCH] RDMA/rxe: Fix OOB in free_rd_atomic_resources()

[PATCH] RDMA/rxe: Fix OOB in free_rd_atomic_resources()

[Peiyang He]

free_rd_atomic_resources() iterates using qp->attr.max_dest_rd_atomic.
Updating max_dest_rd_atomic before freeing the old array can make the
free path walk past the old allocation and trigger a slab out-of-bounds
write.

Fix the OOB by moving the assignment after free_rd_atomic_resources()
so the old array is freed using the old bound. This matches the original
ordering in commit 8700e3e7c485 ("Soft RoCE driver").

Fixes: b6bbee0d2438 ("IB/rxe: Properly honor max IRD value for rd/atomic.")
Cc: stable@vger.kernel.org
Signed-off-by: Peiyang He <peiyang_he@smail.nju.edu.cn>
---
 drivers/infiniband/sw/rxe/rxe_qp.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c
index f3dff1aea96a..1fffe3c6685d 100644
--- a/drivers/infiniband/sw/rxe/rxe_qp.c
+++ b/drivers/infiniband/sw/rxe/rxe_qp.c
@@ -707,10 +707,10 @@ int rxe_qp_from_attr(struct rxe_qp *qp, struct ib_qp_attr *attr, int mask,
 		int max_dest_rd_atomic = attr->max_dest_rd_atomic ?
 			roundup_pow_of_two(attr->max_dest_rd_atomic) : 0;
 
-		qp->attr.max_dest_rd_atomic = max_dest_rd_atomic;
-
 		free_rd_atomic_resources(qp);
 
+		qp->attr.max_dest_rd_atomic = max_dest_rd_atomic;
+
 		err = alloc_rd_atomic_resources(qp, max_dest_rd_atomic);
 		if (err)
 			return err;
-- 
2.43.0

Re: [PATCH] RDMA/rxe: Fix OOB in free_rd_atomic_resources()

[yanjun.zhu]

On 7/29/26 12:36 AM, Peiyang He wrote:
> free_rd_atomic_resources() iterates using qp->attr.max_dest_rd_atomic.
> Updating max_dest_rd_atomic before freeing the old array can make the
> free path walk past the old allocation and trigger a slab out-of-bounds
> write.
> 
> Fix the OOB by moving the assignment after free_rd_atomic_resources()
> so the old array is freed using the old bound. This matches the original
> ordering in commit 8700e3e7c485 ("Soft RoCE driver").
> 
> Fixes: b6bbee0d2438 ("IB/rxe: Properly honor max IRD value for rd/atomic.")
> Cc: stable@vger.kernel.org
> Signed-off-by: Peiyang He <peiyang_he@smail.nju.edu.cn>

Thanks a lot. I am fine with this commit. If you can post the mentioned 
OOB in the commit log, it is better.

But without the OOB, this commit still seems OK.

Wait for the feedback from Leon and Jason.

Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev>

Zhu Yanjun

> ---
>   drivers/infiniband/sw/rxe/rxe_qp.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c
> index f3dff1aea96a..1fffe3c6685d 100644
> --- a/drivers/infiniband/sw/rxe/rxe_qp.c
> +++ b/drivers/infiniband/sw/rxe/rxe_qp.c
> @@ -707,10 +707,10 @@ int rxe_qp_from_attr(struct rxe_qp *qp, struct ib_qp_attr *attr, int mask,
>   		int max_dest_rd_atomic = attr->max_dest_rd_atomic ?
>   			roundup_pow_of_two(attr->max_dest_rd_atomic) : 0;
>   
> -		qp->attr.max_dest_rd_atomic = max_dest_rd_atomic;
> -
>   		free_rd_atomic_resources(qp);
>   
> +		qp->attr.max_dest_rd_atomic = max_dest_rd_atomic;
> +
>   		err = alloc_rd_atomic_resources(qp, max_dest_rd_atomic);
>   		if (err)
>   			return err;