Re: [PATCH] RDMA/rxe: Use validated num_sge in local buffer

[Zhu Yanjun <yanjun.zhu@linux.dev>]

在 2026/9/7 9:15, Nicolas Morey 写道:
> For both SRQ and non-SRQ receive paths, the WQE is copied into a local
> buffer to provide a kernel-owned, validated copy. While calculating the
> memcpy size from the validated num_sge prevents overflow during the
> copy, memcpy() itself still copies num_sge from shared memory.
> 
> A concurrent userspace modification before or during memcpy() leaves
> an unvalidated num_sge in the local buffer, leading to potential
> out-of-bounds reads in rxe_resp_check_length() and copy_data().
> 

Hi Nicolas,

Thanks for the patch. The logic makes total sense to prevent the TOCTOU 
race condition after memcpy.

Just out of curiosity, do you happen to have a reproducer or a POC 
script that demonstrates this race in practice?

It would be great to know if this can be reliably reproduced or 
integrated into testing setups (like rdma-core tests, or 
tools/testing/selftests/rdma) to catch similar double-read issues in the 
future.

Thanks a lot for your effort.

Zhu Yanjun

> Explicitly assign the validated num_sge to the local buffer after the
> copy to prevent this race.
> 
> Fixes: 22b8fbded65b ("RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe")
> Fixes: d6ab440240a0 ("RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path")
> Signed-off-by: Nicolas Morey <nmorey@suse.com>
> ---
>   drivers/infiniband/sw/rxe/rxe_resp.c | 2 ++
>   1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c
> index 02b16e2b49b8..cd51042857d6 100644
> --- a/drivers/infiniband/sw/rxe/rxe_resp.c
> +++ b/drivers/infiniband/sw/rxe/rxe_resp.c
> @@ -288,6 +288,7 @@ static enum resp_states get_srq_wqe(struct rxe_qp *qp)
>   	}
>   	size = sizeof(*wqe) + num_sge * sizeof(struct rxe_sge);
>   	memcpy(&qp->resp.srq_wqe, wqe, size);
> +	qp->resp.srq_wqe.wqe.dma.num_sge = num_sge;
>   
>   	qp->resp.wqe = &qp->resp.srq_wqe.wqe;
>   	queue_advance_consumer(q, QUEUE_TYPE_FROM_CLIENT);
> @@ -328,6 +329,7 @@ static enum resp_states rxe_get_recv_wqe(struct rxe_qp *qp)
>   	}
>   	size = sizeof(*wqe) + num_sge * sizeof(struct rxe_sge);
>   	memcpy(&qp->resp.srq_wqe, wqe, size);
> +	qp->resp.srq_wqe.wqe.dma.num_sge = num_sge;
>   
>   	qp->resp.wqe = &qp->resp.srq_wqe.wqe;
>   	return RESPST_CHK_LENGTH;