From: Bjoern Doebel <doebel@amazon.de>
To: <stable@vger.kernel.org>
Cc: <gregkh@linuxfoundation.org>, <sashal@kernel.org>,
<linux-rdma@vger.kernel.org>,
Tristan Madani <tristan@talencesecurity.com>,
Bob Pearson <rpearsonhpe@gmail.com>,
Dan Carpenter <dan.carpenter@linaro.org>,
Jason Gunthorpe <jgg@nvidia.com>,
Zhu Yanjun <yanjun.zhu@linux.dev>, <doebel@amazon.de>
Subject: [PATCH 5.10.y 0/4] RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe
Date: Thu, 3 Sep 2026 20:08:47 +0000 [thread overview]
Message-ID: <20260903200851.566276-1-doebel@amazon.de> (raw)
Upstream commit 22b8fbded65b ("RDMA/rxe: Fix TOCTOU heap overflow in
get_srq_wqe") fixes a heap buffer overflow in the rxe responder.
The fix does not apply to 5.10.y as-is because get_srq_wqe() there
predates three earlier cleanups. This series therefore backports those
prerequisites from 5.14 first, and then the actual fix:
1/4 ec0fa2445c18 RDMA/rxe: Fix over copying in get_srq_wqe
(context adjusted for 5.10)
2/4 36941dfe0e8c RDMA/rxe: Missing unlock on error in get_srq_wqe()
(clean cherry-pick)
3/4 e2a05339fa11 RDMA/rxe: Use the correct size of wqe when processing SRQ
(clean cherry-pick)
4/4 22b8fbded65b RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe
(cherry-picked from the v6.1.178 backport 3cfa2a3adc51, context
adjusted)
Tested in the Amazon Linux kernel test suite.
Bjoern
Bob Pearson (2):
RDMA/rxe: Fix over copying in get_srq_wqe
RDMA/rxe: Use the correct size of wqe when processing SRQ
Dan Carpenter (1):
RDMA/rxe: Missing unlock on error in get_srq_wqe()
Tristan Madani (1):
RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe
drivers/infiniband/sw/rxe/rxe_resp.c | 13 +++++++++++--
1 file changed, 11 insertions(+), 2 deletions(-)
--
2.50.1
next reply other threads:[~2026-09-03 20:09 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-03 20:08 Bjoern Doebel [this message]
2026-09-03 20:08 ` [PATCH 5.10.y 1/4] RDMA/rxe: Fix over copying in get_srq_wqe Bjoern Doebel
2026-09-03 20:08 ` [PATCH 5.10.y 2/4] RDMA/rxe: Missing unlock on error in get_srq_wqe() Bjoern Doebel
2026-09-03 20:08 ` [PATCH 5.10.y 3/4] RDMA/rxe: Use the correct size of wqe when processing SRQ Bjoern Doebel
2026-09-03 20:08 ` [PATCH 5.10.y 4/4] RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe Bjoern Doebel
2026-09-06 13:32 ` [PATCH 5.10.y 0/4] " Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260903200851.566276-1-doebel@amazon.de \
--to=doebel@amazon.de \
--cc=dan.carpenter@linaro.org \
--cc=gregkh@linuxfoundation.org \
--cc=jgg@nvidia.com \
--cc=linux-rdma@vger.kernel.org \
--cc=rpearsonhpe@gmail.com \
--cc=sashal@kernel.org \
--cc=stable@vger.kernel.org \
--cc=tristan@talencesecurity.com \
--cc=yanjun.zhu@linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox