For a user QP, rxe_post_send() takes the qp->is_user branch and never runs init_send_wqe(), so dma.length/resid/num_sge/cur_sge/sge_offset all come straight from the mmap'd SQ ring. In the inline send path finish_packet() uses sge_offset directly as an index: u8 *tmp = &wqe->dma.inline_data[wqe->dma.sge_offset]; memcpy(payload_addr(pkt), tmp, payload); inline_data is a flex array whose capacity is qp->sq.max_inline, but sge_offset is a u32 from user space, so the source pointer is displaced arbitrarily past the WQE and the memcpy reads out of bounds. commit 126c757e4cd4 ("RDMA/rxe: Validate num_sge/cur_sge before indexing wqe->dma.sge[]") added num_sge/cur_sge checks on the send path but not sge_offset, the third attacker-controlled index in the same struct. Read sge_offset once with READ_ONCE() and bound it (and the payload that follows it) by qp->sq.max_inline before indexing, so the value that is validated is the value that is used. Fixes: 8700e3e7c485 ("Soft RoCE driver") Cc: stable@vger.kernel.org Signed-off-by: Youngsung Ahn Assisted-by: LLM --- Notes (not part of the commit): Reproduced on 7.3-rc4 as uid 1000: "BUG: unable to handle page fault ... memcpy+0xc/0x30" from rxe_requester, 4/4. Present unchanged in mainline 551c722f4080 (2026-09-29) and rdma for-next. Compile-tested (KASAN+RDMA_RXE), not runtime-tested. Found through manual review; per security-bugs.rst this is public and a reproducer can be shared on request. v2: the WQE lives in the mmap'd ring, so read dma.sge_offset once with READ_ONCE() into a local and validate/index that local, closing the TOCTOU noted in automated review (v1 re-read the field after the bounds check). Dropped security@kernel.org Cc. drivers/infiniband/sw/rxe/rxe_req.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c index 24f5c044363f..06e24d818075 100644 --- a/drivers/infiniband/sw/rxe/rxe_req.c +++ b/drivers/infiniband/sw/rxe/rxe_req.c @@ -510,7 +510,14 @@ static int finish_packet(struct rxe_qp *qp, struct rxe_av *av, if (pkt->mask & RXE_WRITE_OR_SEND_MASK) { if (wqe->wr.send_flags & IB_SEND_INLINE) { - u8 *tmp = &wqe->dma.inline_data[wqe->dma.sge_offset]; + u32 sge_offset = READ_ONCE(wqe->dma.sge_offset); + u8 *tmp; + + if (unlikely(sge_offset > (u32)qp->sq.max_inline || + payload > (u32)qp->sq.max_inline - sge_offset)) + return -EINVAL; + + tmp = &wqe->dma.inline_data[sge_offset]; memcpy(payload_addr(pkt), tmp, payload); -- 2.43.0