Re: [PATCH v3] RDMA/rxe: validate num_sge/cur_sge before indexing wqe->dma.sge[]

[Leon Romanovsky]

On Sun, 12 Jul 2026 14:21:49 +0200, Ibrahim Hashimov wrote:
> For a user QP, qp->sq.queue is a ring the application writes directly,
> so rxe_post_send() takes the is_user branch and only schedules send_task
> without validating the WQE. rxe_requester() consumes it in place via
> req_next_wqe() and calls copy_data(), which indexes
> &wqe->dma.sge[cur_sge] with the attacker-controlled num_sge/cur_sge.
> Only the kernel path bounds num_sge (validate_send_wr()); the user WQE
> is never checked, so a local unprivileged user can post a WQE with an
> out-of-range cur_sge or oversized num_sge and force an out-of-bounds
> read of the per-WQE sge array in copy_data() (vmalloc OOB read, local
> DoS).
> 
> [...]

Applied, thanks!

[1/1] RDMA/rxe: validate num_sge/cur_sge before indexing wqe->dma.sge[]
      https://git.kernel.org/rdma/rdma/c/59d3005eb36f37

Best regards,
-- 
Leon Romanovsky <leon@xxxxxxxxxx>