Re: [PATCH v3] RDMA/rxe: fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp

[Leon Romanovsky]

On Sun, 12 Jul 2026 14:17:20 +0200, Ibrahim Hashimov wrote:
> rxe_qp_from_attr() handles IB_QP_MAX_DEST_RD_ATOMIC outside the
> IB_QP_STATE path, so it holds no state_lock and runs while the responder
> task rxe_receiver() (recv_task on rxe_wq) is live. A modify_qp() setting
> only that attribute calls free_rd_atomic_resources() then
> alloc_rd_atomic_resources(), swapping qp->resp.resources[] while
> rxe_prepare_res()/find_resource() walk it; free_rd_atomic_resources()
> also leaves the cached pointer qp->resp.res dangling. A local
> unprivileged user can race the free/realloc into a use-after-free in
> rxe_receiver() (local DoS).
> 
> [...]

Applied, thanks!

[1/1] RDMA/rxe: fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp
      https://git.kernel.org/rdma/rdma/c/a37da605b395b9

Best regards,
-- 
Leon Romanovsky <leon@xxxxxxxxxx>