Re: [PATCH v3 0/2] RDMA/rxe: fix ADVISE_MR prefetch on non-ODP MRs

[Leon Romanovsky]

On Wed, 23 Sep 2026 16:40:48 +0200, Norbert Szetei wrote:
> ADVISE_MR prefetch on a plain MR runs to_ib_umem_odp() on a struct
> ib_umem, giving a KASAN slab-out-of-bounds read in
> ib_umem_odp_map_dma_and_lock() (splat in patch 2).
> 
> v1 checked is_odp_mr() after lookup_mr(). Leon asked for lookup_mr() to
> do the check itself, off mr->access. That only holds once mr->access
> cannot disagree with the umem, so patch 1 stops the two paths that
> assign mr->access after registration from touching IB_ACCESS_ON_DEMAND,
> and patch 2 passes the flag to lookup_mr() in both prefetch arms.
> 
> [...]

Applied, thanks!

[1/2] RDMA/rxe: Reject IB_ACCESS_ON_DEMAND changes after MR creation
      https://git.kernel.org/rdma/rdma/c/2dac7006b9fb46
[2/2] RDMA/rxe: Reject prefetch of a non-ODP MR
      https://git.kernel.org/rdma/rdma/c/66f18a749a3eee

Best regards,
-- 
Leon Romanovsky <leon@xxxxxxxxxx>