ADVISE_MR prefetch on a plain MR runs to_ib_umem_odp() on a struct
ib_umem, giving a KASAN slab-out-of-bounds read in
ib_umem_odp_map_dma_and_lock() (splat in patch 2).
v1 checked is_odp_mr() after lookup_mr(). Leon asked for lookup_mr() to
do the check itself, off mr->access. That only holds once mr->access
cannot disagree with the umem, so patch 1 stops the two paths that
assign mr->access after registration from touching IB_ACCESS_ON_DEMAND,
and patch 2 passes the flag to lookup_mr() in both prefetch arms.
Patch 1 adds another failure return to rxe_rereg_user_mr(), so it
depends on ae36a5b609ae ("RDMA/rxe: validate access flags before
swapping the MR's PD"), which moved the validation above the
mr->ibmr.pd swap. The series is based on for-rc.
v1 -> v2:
- patch 1 (new): reject IB_ACCESS_ON_DEMAND in rxe_rereg_user_mr() and
rxe_reg_fast_mr(), so mr->access keeps agreeing with the umem
- patch 2: use lookup_mr(..., IB_ACCESS_ON_DEMAND) instead of an
explicit is_odp_mr() check; a non-ODP MR now fails with -EINVAL from
lookup_mr() rather than -EOPNOTSUPP
- dropped Zhu Yanjun's Reviewed-by, the implementation changed
v1: https://lore.kernel.org/all/521D5E74-89E3-43C0-81C7-AC0BE52591E7@doyensec.com/
Signed-off-by: Norbert Szetei <norbert@doyensec.com>
---
Norbert Szetei (2):
RDMA/rxe: Reject IB_ACCESS_ON_DEMAND changes after MR creation
RDMA/rxe: Reject prefetch of a non-ODP MR
drivers/infiniband/sw/rxe/rxe_mr.c | 6 ++++++
drivers/infiniband/sw/rxe/rxe_odp.c | 4 ++--
drivers/infiniband/sw/rxe/rxe_verbs.c | 6 ++++++
3 files changed, 14 insertions(+), 2 deletions(-)
---
base-commit: e22a3627b7151754f07f90ea3d1ab6e85f5d93f4
change-id: 20260913-rxe-advise-mr-v2-97b102b7bb6c
Best regards,
--
Norbert Szetei <norbert@doyensec.com>