Re: [PATCH] RDMA/rxe: Use validated num_sge in local buffer

[Zhu Yanjun]

在 2026/9/7 14:44, Nicolas Morey 写道:
> On 2026-09-07 23:20, Zhu Yanjun wrote:
> > 在 2026/9/7 9:15, Nicolas Morey 写道:
> > > For both SRQ and non-SRQ receive paths, the WQE is copied into a local
> > > buffer to provide a kernel-owned, validated copy. While calculating the
> > > memcpy size from the validated num_sge prevents overflow during the
> > > copy, memcpy() itself still copies num_sge from shared memory.
> > >
> > > A concurrent userspace modification before or during memcpy() leaves
> > > an unvalidated num_sge in the local buffer, leading to potential
> > > out-of-bounds reads in rxe_resp_check_length() and copy_data().
> >
> > Hi Nicolas,
> >
> > Thanks for the patch. The logic makes total sense to prevent the TOCTOU race condition after memcpy.
> >
> > Just out of curiosity, do you happen to have a reproducer or a POC script that demonstrates this race in practice?
> >
> > It would be great to know if this can be reliably reproduced or integrated into testing setups (like rdma-core tests, or tools/testing/selftests/rdma) to catch similar double-read issues in the future.
>
> No reproducer or PoC sadly. I haven't tried to make one though.
> This got caught by one of our AI tools when checking the backport of CVE-2026-74377.

Hi, Nicolas

Thanks for sharing this. Could you clarify whether your AI tool detected 
this purely through static analysis (and provided a suggested fix), or 
if it actually triggered a runtime bug with a backtrace/calltrace?

If you have a calltrace, please share it—that would help a lot in 
understanding the issue. Also, if this was flagged and fixed by a 
specific AI tool, adding an Assisted-by: tag (or referencing the tool in 
the commit description) would be appropriate.

Thanks,

Zhu Yanjun

> I assumed from the 2 existing fixes (ending up as CVEs) that this could happened.
>
> Nicolas