Re: [PATCH v2] RDMA/rxe: Fix OOB in free_rd_atomic_resources()
Leon Romanovsky <[email protected]>
| Newsgroups | org.kernel.vger.linux-rdma,org.kernel.vger.linux-kernel,org.kernel.vger.stable |
|---|---|
| Message-ID | <[email protected]> |
On Thu, 30 Jul 2026 10:28:27 +0800, Peiyang He wrote:
> free_rd_atomic_resources() iterates using qp->attr.max_dest_rd_atomic.
> Updating max_dest_rd_atomic before freeing the old array can make the
> free path walk past the old allocation and trigger a slab out-of-bounds
> write catched by KASAN:
> ==================================================================
> BUG: KASAN: slab-out-of-bounds in free_rd_atomic_resource drivers/infiniband/sw/rxe/rxe_qp.c:180 [inline]
> BUG: KASAN: slab-out-of-bounds in free_rd_atomic_resources drivers/infiniband/sw/rxe/rxe_qp.c:171 [inline]
> BUG: KASAN: slab-out-of-bounds in free_rd_atomic_resources drivers/infiniband/sw/rxe/rxe_qp.c:163 [inline]
> BUG: KASAN: slab-out-of-bounds in rxe_qp_from_attr+0x1e88/0x2150 drivers/infiniband/sw/rxe/rxe_qp.c:712
> Write of size 4 at addr ffff88802b8dddb8 by task syz.3.451/11063
>
> [...]
Applied, thanks!
[1/1] RDMA/rxe: Fix OOB in free_rd_atomic_resources()
https://git.kernel.org/rdma/rdma/c/2f96d52eabe576
Best regards,
--
Leon Romanovsky <[email protected]>