diff options
| author | Tristan Madani <tristmd@gmail.com> | 2026-05-18 21:50:39 +0000 |
|---|---|---|
| committer | Jason Gunthorpe <jgg@nvidia.com> | 2026-05-29 20:32:48 -0300 |
| commit | 22b8fbded65b8c441b634a185f8da67657df6c50 (patch) | |
| tree | 3a871e0f19632677472f48279b376bfcc3cbc6dd /include/linux/objtool_types.h | |
| parent | 3b6384dac14a306fd3d8e4357b5191a6f2b7f52e (diff) | |
RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe
get_srq_wqe() reads wqe->dma.num_sge from the shared receive queue
buffer, which is mapped into userspace. It validates num_sge against
max_sge, but then re-reads the same field to calculate the memcpy
size. A concurrent userspace thread can modify num_sge between
validation and use, causing a heap buffer overflow when copying the
WQE into qp->resp.srq_wqe.
Read num_sge into a local variable and use it for both the bounds
check and the size calculation.
Fixes: 8700e3e7c485 ("Soft RoCE driver")
Link: https://patch.msgid.link/r/20260518215040.1598586-2-tristan@talencesecurity.com
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Diffstat (limited to 'include/linux/objtool_types.h')
0 files changed, 0 insertions, 0 deletions