Re: [PATCH v10 0/2] RDMA/rxe: copy send WQE to kernel buffer (TOCTOU hardening)

[Leon Romanovsky]

On Fri, 30 Oct 2026 19:32:33 +0000, Tristan Madani wrote:
> The SoftRoCE (rxe) send queue is mmap-ed into userspace, allowing
> the requester and completer to process work queue entries (WQEs)
> whose fields can change between kernel reads.
> 
> This series copies each WQE to a kernel-private buffer before
> processing: patch 1 for the requester, patch 2 for the completer.
> Both paths validate opcode bounds and SGE indices after copying,
> preserve DMA progress across multi-packet operations, and write
> back updated fields to the shared queue via WRITE_ONCE / smp_store_release.
> 
> [...]

Applied, thanks!

[1/2] RDMA/rxe: copy send WQE to kernel buffer before processing
      https://git.kernel.org/rdma/rdma/c/a668a8564748d5
[2/2] RDMA/rxe: copy send WQE to kernel buffer in completer path
      https://git.kernel.org/rdma/rdma/c/195c20429f13fd

Best regards,
-- 
Leon Romanovsky <leon@xxxxxxxxxx>