Re: [PATCH v2] RDMA/rxe: Use validated num_sge in local buffer

[Leon Romanovsky]

On Wed, 09 Sep 2026 18:01:31 +0200, Nicolas Morey wrote:
> For both SRQ and non-SRQ receive paths, the WQE is copied into a local
> buffer to provide a kernel-owned, validated copy. While calculating the
> memcpy size from the validated num_sge prevents overflow during the
> copy, memcpy() itself still copies num_sge from shared memory.
> 
> A concurrent userspace modification before or during memcpy() leaves
> an unvalidated num_sge in the local buffer, leading to potential
> out-of-bounds reads in rxe_resp_check_length() and copy_data() causing:
> 
> [...]

Applied, thanks!

[1/1] RDMA/rxe: Use validated num_sge in local buffer
      https://git.kernel.org/rdma/rdma/c/112f2b6925c2d7

Best regards,
-- 
Leon Romanovsky <leon@xxxxxxxxxx>