Re: [PATCH] RDMA/rxe: Use validated num_sge in local buffer

[Nicolas Morey]

On 2026-09-07 23:20, Zhu Yanjun wrote:
> 在 2026/9/7 9:15, Nicolas Morey 写道:
>> For both SRQ and non-SRQ receive paths, the WQE is copied into a local
>> buffer to provide a kernel-owned, validated copy. While calculating the
>> memcpy size from the validated num_sge prevents overflow during the
>> copy, memcpy() itself still copies num_sge from shared memory.
>>
>> A concurrent userspace modification before or during memcpy() leaves
>> an unvalidated num_sge in the local buffer, leading to potential
>> out-of-bounds reads in rxe_resp_check_length() and copy_data().
>>
> 
> Hi Nicolas,
> 
> Thanks for the patch. The logic makes total sense to prevent the TOCTOU race condition after memcpy.
> 
> Just out of curiosity, do you happen to have a reproducer or a POC script that demonstrates this race in practice?
> 
> It would be great to know if this can be reliably reproduced or integrated into testing setups (like rdma-core tests, or tools/testing/selftests/rdma) to catch similar double-read issues in the future.
> 

No reproducer or PoC sadly. I haven't tried to make one though.
This got caught by one of our AI tools when checking the backport of CVE-2026-74377.

I assumed from the 2 existing fixes (ending up as CVEs) that this could happened.

Nicolas