From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wr2-f12.google.com (mail-wr2-f12.google.com [74.125.225.76]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4130039524E for ; Mon, 7 Sep 2026 21:44:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.225.76 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788817449; cv=none; b=LTHhyrb7agdFg077/VqBcjFGutCaJjdqzIvPsYLFN3DAcct/TsQfSdW9VpiGgC9wHUbYPUaJbKFuoj/CLRa8fCGcq4P8AUevybPRs+6pSqEVuPpcgbiCNdrWW7G+7hjLlJKfEfy2eR8736a5lHmM8ggvg1DXWMUzJVWqhzPnr/E= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788817449; c=relaxed/simple; bh=kpXyO1Lh3KGAvYZaURiBKRlh0cghrR52T1tvf40z3bs=; h=Message-ID:Date:MIME-Version:Subject:To:References:From: In-Reply-To:Content-Type; b=KOWPvlwDhb49+6/DXhxzNMBWnU+wczyojs3GLgI47W+2V4n5/tvYEAB/8IOPUurD4GDSmClpZMKuHjzienGbPs1LjCmna9jRx43to1L+harovkKuZcluinQLoHb+h913fs+S65kEtv9Y/yVwVGziDMQhVrHbWyMmrFrK50B8Lsc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=suse.com; spf=pass smtp.mailfrom=suse.com; dkim=pass (2048-bit key) header.d=suse.com header.i=@suse.com header.b=GdQ7JsE8; arc=none smtp.client-ip=74.125.225.76 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=suse.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=suse.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=suse.com header.i=@suse.com header.b="GdQ7JsE8" Received: by mail-wr2-f12.google.com with SMTP id ffacd0b85a97d-48436686a40so246393f8f.3 for ; Mon, 07 Sep 2026 14:44:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.com; s=google; t=1788817446; x=1789422246; darn=vger.kernel.org; h=content-transfer-encoding:content-type:in-reply-to:autocrypt:from :content-language:references:to:subject:user-agent:mime-version:date :message-id:from:to:cc:subject:date:message-id:reply-to:content-type; bh=QZNaXJghCpqSS6WvG2CJpCXyuhSjyxQRoo++ZoILTFY=; b=GdQ7JsE8RVsjFTM6bHF8Wu8swLLtoH4cSbaWdF/zdPfVgt473I2KblftAPzArbScI/ 0C4/yMy+R0r07Kn7i8hx1tjdHg924Auusbc2Mfr+VKsBXJJ2jZ+eLwmbwl7n47mbTXDr Ae8y9aESW9eufom4DmPg/iKfUg7KB/Qd/fkqVeg00VEhkunIpXIyNP/N8HCRLK5MpeII V8+0yHSrfVVH9CjFv2m614Nn9khGUNR7mmWEMzcpf2lfFTKgdOe+fj6ZoTrj6FTcIUsF tx2OL9QXuiEDUpHpHZksCIYYJrIz6IscbrpQZvq8xU4kCxwxX2VbtjsgDlrNIuJg1bZ2 jqsQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788817446; x=1789422246; h=content-transfer-encoding:content-type:in-reply-to:autocrypt:from :content-language:references:to:subject:user-agent:mime-version:date :message-id:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=QZNaXJghCpqSS6WvG2CJpCXyuhSjyxQRoo++ZoILTFY=; b=CInjiWq8NJQZneLRBkY256AyXR06KlcHp1e85hvTRztx7ZTgx/m36LTzBFR/wuRp5Z CB35yScdH9mBfRZ5cHHYtexpLKIInHqlbzbGk+Kt02TqiKqSeHvckYPF6RFEWIPxRLx6 WVAE2yDVjVtYFu6eFeW2lvQLrYJpRT/nQE0dInTd3aQGiqD2EVnT/Zk9UJx0GFLV4Wri 3Pyyigmfgkix56bNk9WdMdFeq5Wd/LUr2ejz3wT72Lwzifb67YXIYdRU1/4v0eQRKyOd AVlZ7cCcfPmDB0DA1V3sqHEZIU7Zag/FqWDKSSHlQMlVi2R7YbNTxyULCtdwTkLCatz/ LZlg== X-Forwarded-Encrypted: i=1; AKwUvBxLGaA/sL5HRcP/41blStbTvoO6PJBiCIu13POyEHIEFNQaKx5O4kzTcZr+g5SXBG7x+hJzpZJCRHprBBE=@vger.kernel.org X-Gm-Message-State: AFuF++mQOtxizyxc+c1e2A6JpPAiGysm9AXUQV6D982Bb3itA6eiDnFl JavnC1vTY/5tKvaWhOki4NI8aaNGDGPE3BhzrMNOydOzY5gAPLYsV4dBR4ATBQjlAuc= X-Gm-Gg: AYBFou16jR4Us8XwJeo5J0HXm3TktytJzun8AitvDGRwjzJwy6Og8LGxWp7wmBPpuEz /3Zwfy6qyzVkOmAhRsg31MLnrJun3DN2FIMRobyyJMuXksXM4YdlkPALdlJL2I+I3HzWVEnTH5C DS7/tuyw3cZoSq9wMcbnClD3u82eg6W6SLaGXiTLx4Y+Yk8Cuogcgvz4aP60ilM6NgOQLQ1ZWHi iG7Azu1srlhuYwCtf3lBTDkn7y1zU4dIqnqXah0L9jP4h01MB5zSYIHJZZq1k0JQQGB8p8fkJ6T 8caZhgY1Og0vSmUyK3ucNnYmtzrAxK7MvJ09J4KeMeU5Pz4yLoPi9nAZeIYZM5WtxSrhdZwRNGE Foy+lPqvJn2pxmYdZwpHFQNMTRpW2UuHJ9bIriK5HZweHDmrFND6TUb+fXUKDYQEIEL6UbNtNJx wf+9ehlCQhks4SMeZHDxWeaku+cXRBLp4pcOdaW2NkKvvW/XGo/js/3SH5gs5ohtohAoexZ07hW Ze1vvXGxOlBJXcad3EQ/d2j0AlQVUU= X-Received: by 2002:a5d:5e0a:0:b0:484:3200:b7a6 with SMTP id ffacd0b85a97d-485907ec2c3mr16379341f8f.4.1788817446526; Mon, 07 Sep 2026 14:44:06 -0700 (PDT) Received: from [10.20.0.128] (lfbn-ann-1-199-252.w86-200.abo.wanadoo.fr. [86.200.161.252]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-4859162f354sm23836899f8f.20.2026.09.07.14.44.05 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 07 Sep 2026 14:44:06 -0700 (PDT) Message-ID: <681ae665-523a-441b-bbd8-dbae51ee64f1@suse.com> Date: Mon, 7 Sep 2026 23:44:05 +0200 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] RDMA/rxe: Use validated num_sge in local buffer To: Zhu Yanjun , Zhu Yanjun , Jason Gunthorpe , Leon Romanovsky , Tristan Madani , "open list:SOFT-ROCE DRIVER (rxe)" , open list References: <20260907161550.716670-1-nmorey@suse.com> <27376486-9cab-4d42-8ed7-36e13231dd91@linux.dev> Content-Language: fr, en-GB From: Nicolas Morey Autocrypt: addr=nmorey@suse.com; keydata= xsBNBFjZETwBCADEkoe7QWAXzd9xpSiPbQK6P2F4wKdxyTp6r0aN4I0O+4fc8xWXvmwOrCjF UsuoGZ3CxJaHgdB/3ueW/IhMO5Ldz7pylhKVlG/moUh4CBK2eRUdaG7mHID01GyJMtR3VQqu 22hJhHPYy0erpYViyr+I4MzQA9QZLoQhSxn4imjZOZPcj20JE+lRfXppNv9g7vQiRLMcXjTi KcnrqG5owOi6Cn1sZ201YfdeztGxKA+jvjWO+6absTTlorIlZNGUf85s2+caGDsqa31u2DPs hVv5UUTy1g/5aP2wacSWI3Qm4n2MWl1aCnHN2h737PCXXfBk5iGJsgBUnSQULgdgEAt1ABEB AAHNH05pY29sYXMgTW9yZXkgPG5tb3JleUBzdXNlLmNvbT7CwI4EEwEIADgWIQRC0lOFwaHA K4sbHG+AG924JZiPZAUCY5G8SAIbAwULCQgHAgYVCgkICwIEFgIDAQIeAQIXgAAKCRCAG924 JZiPZMZiB/9QkcGfH248qvFUWZig3jssK5IgijfOFDKB0YK4e844M5C8LVSuWpu7Z+lM+cql 3mbrikW6mlZjPEusrQ/KGvT6TdfOM9VCQWjlshMzt7uiRDdzufHGtE5hhk/67UnkEVjmplpD k8cb1O0VsBfGym7e0nySHTlDWqr++9EcwgV3uo4psYYEqm6Aon1yKqjbmj+vfl/C5iW3V4lq DhBk8w21AvNS+tdEqJzhruxuXkEDZZ07wYFS7m8OxLNb4sMzn/Nz9x/NXeweBWx2ujIERtAq 1e/hh0ZAcoPVR3CfO2QTmfTfrzVdpZrZ8F54337ze3+BUNnrFGObQhlNe26NqNYWzsBNBFjZ ETwBCAC9zAzCRlTgzyO9siVLQYwbRUhcL1TUJU/FiOQWQTmL3uDdBc6MgVBs+hp82RwPbbXT v4W4rghBYPKdmFXvRN+jvGDLq1f2hsuCSiE1ckTMzFV+sKoWRIEC12tEpw5ncEFGm+1k/rJR Lk9eHxuqn+yRjPryN8CK6tK4+b4tZ2urKlP29XG+T3l/mbUSoqfjqvyeKaW6xw7ku89EX2Xo QWP/pm92RxUd6VDU9vpVW/T7qPZRl0wtUnDnO2wePoZmvUfEr5Osh3MNvm1myG+v4EV2Hgva NT6pa27IptrUq06cA6dDsIKwPtMuThJQp8/xumgl5Q9A/ErQoJTrB9rclIm7ABEBAAHCwF8E GAECAAkFAljZETwCGwwACgkQgBvduCWYj2QwNwf/eOIpFB67cKoUJvcm3JWcvnagZOuyasCw xwH9a0o9jORcq+nsJoynS/DpjUKGyZagy7+F7sBrF7Xx0cXF2f5Bo42XNNiQDE5P/VLwvgn9 62AJ3q0dp4O7oQI8UgNmdsocQhNaBHHCoOabLGrgNobDTaLBeb9zaOZqz8CBuAiZ0bVABEpg 50hDEYTHp4jCgWpadhAsp/eCgm93Tc+Y+e1fqtE3FmoOLxyhFa6evhn0Q1iX0kCasMZwlzse zqLZjTM1Koqn6+UIHXE3QaULyFKD1GDhisXxyolOB6P2TXsyfvitYdIZ3CCtI7PVDxzmX2Xk kvEz9bMtStoMpse9qAsmHQ== In-Reply-To: <27376486-9cab-4d42-8ed7-36e13231dd91@linux.dev> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit On 2026-09-07 23:20, Zhu Yanjun wrote: > 在 2026/9/7 9:15, Nicolas Morey 写道: >> For both SRQ and non-SRQ receive paths, the WQE is copied into a local >> buffer to provide a kernel-owned, validated copy. While calculating the >> memcpy size from the validated num_sge prevents overflow during the >> copy, memcpy() itself still copies num_sge from shared memory. >> >> A concurrent userspace modification before or during memcpy() leaves >> an unvalidated num_sge in the local buffer, leading to potential >> out-of-bounds reads in rxe_resp_check_length() and copy_data(). >> > > Hi Nicolas, > > Thanks for the patch. The logic makes total sense to prevent the TOCTOU race condition after memcpy. > > Just out of curiosity, do you happen to have a reproducer or a POC script that demonstrates this race in practice? > > It would be great to know if this can be reliably reproduced or integrated into testing setups (like rdma-core tests, or tools/testing/selftests/rdma) to catch similar double-read issues in the future. > No reproducer or PoC sadly. I haven't tried to make one though. This got caught by one of our AI tools when checking the backport of CVE-2026-74377. I assumed from the 2 existing fixes (ending up as CVEs) that this could happened. Nicolas