Re: [PATCH v2] RDMA/rxe: Fix OOB in free_rd_atomic_resources()

[Leon Romanovsky]

On Thu, 30 Jul 2026 10:28:27 +0800, Peiyang He wrote:
> free_rd_atomic_resources() iterates using qp->attr.max_dest_rd_atomic.
> Updating max_dest_rd_atomic before freeing the old array can make the
> free path walk past the old allocation and trigger a slab out-of-bounds
> write catched by KASAN:
> ==================================================================
> BUG: KASAN: slab-out-of-bounds in free_rd_atomic_resource drivers/infiniband/sw/rxe/rxe_qp.c:180 [inline]
> BUG: KASAN: slab-out-of-bounds in free_rd_atomic_resources drivers/infiniband/sw/rxe/rxe_qp.c:171 [inline]
> BUG: KASAN: slab-out-of-bounds in free_rd_atomic_resources drivers/infiniband/sw/rxe/rxe_qp.c:163 [inline]
> BUG: KASAN: slab-out-of-bounds in rxe_qp_from_attr+0x1e88/0x2150 drivers/infiniband/sw/rxe/rxe_qp.c:712
> Write of size 4 at addr ffff88802b8dddb8 by task syz.3.451/11063
> 
> [...]

Applied, thanks!

[1/1] RDMA/rxe: Fix OOB in free_rd_atomic_resources()
      https://git.kernel.org/rdma/rdma/c/2f96d52eabe576

Best regards,
-- 
Leon Romanovsky <leon@xxxxxxxxxx>