[PATCH v9 0/2] RDMA/rxe: copy send WQE to kernel buffer (TOCTOU hardening)

[Tristan Madani]

The SoftRoCE (rxe) send queue is mmap-ed into userspace, allowing
the requester and completer to process work queue entries (WQEs)
whose fields can change between kernel reads.

This series copies each WQE to a kernel-private buffer before
processing: patch 1 for the requester, patch 2 for the completer.
Both paths validate opcode bounds and SGE indices after copying,
preserve DMA progress across multi-packet operations, and write
back updated fields to the shared queue via WRITE_ONCE / smp_store_release.

Changes since v8:
  - Patch 1: fix atomic write resid check -- use WR_ATOMIC_WRITE_MASK
    (WR-level) instead of RXE_ATOMIC_WRITE_MASK (packet-level), and
    clamp dma.resid instead of setting mask to 0 (sashiko finding).
  - Patch 1: invalidate completer WQE cache on retry so the
    completer re-reads after retransmission.
  - Patch 2: write back DMA progress after each intermediate response
    packet so a forced cache re-read picks up current progress.

Tristan Madani (2):
  RDMA/rxe: copy send WQE to kernel buffer before processing
  RDMA/rxe: copy send WQE to kernel buffer in completer path

 drivers/infiniband/sw/rxe/rxe_comp.c  | 76 ++++++++++++++++++++++++++-
 drivers/infiniband/sw/rxe/rxe_qp.c    |  2 +
 drivers/infiniband/sw/rxe/rxe_req.c   | 72 +++++++++++++++++++++++--
 drivers/infiniband/sw/rxe/rxe_verbs.h | 12 +++++
 4 files changed, 155 insertions(+), 7 deletions(-)

-- 
2.47.3