Re: [PATCH v2 0/2] RDMA/rxe: fix ADVISE_MR prefetch on non-ODP MRs

[Leon Romanovsky <leon@kernel.org>]

On Sun, Sep 13, 2026 at 01:45:14PM +0200, Norbert Szetei via B4 Relay wrote:
> ADVISE_MR prefetch on a plain MR runs to_ib_umem_odp() on a struct
> ib_umem, giving a KASAN slab-out-of-bounds read in
> ib_umem_odp_map_dma_and_lock() (splat in patch 2).
> 
> v1 checked is_odp_mr() after lookup_mr(). Leon asked for lookup_mr() to
> do the check itself, off mr->access. That only holds once mr->access
> cannot disagree with the umem, so patch 1 stops the two paths that
> assign mr->access after registration from touching IB_ACCESS_ON_DEMAND,
> and patch 2 passes the flag to lookup_mr() in both prefetch arms.
> 
> Patch 1 adds another failure return to rxe_rereg_user_mr(), so it
> depends on ae36a5b609ae ("RDMA/rxe: validate access flags before
> swapping the MR's PD"), which moved the validation above the
> mr->ibmr.pd swap. The series is based on for-rc.

Please rebase it on top of for-next.

Thanks