Linux kernel Soft-RoCE responder (rdma_rxe, non-SRQ receive WQE handling): A textbook time-of-check-to-time-of-use

Impact

A textbook time-of-check-to-time-of-use across the userspace/kernel RDMA boundary. For non-SRQ queue pairs the responder read work-queue-entry fields - including num_sge and the SGE array itself - directly out of the queue buffer that is mapped shared into the tenant's address space. The tenant flips num_sge or an SGE length after the kernel validates it and before it uses it, producing out-of-bounds reads in rxe_resp_check_length() and copy_data(). The attacker controls both the trigger and the timing, and the read lands wherever the forged SGE points.

Who can reach it

Local, unprivileged: a tenant with a Soft-RoCE device races its own shared receive-queue memory against the kernel responder while inbound traffic is being processed.

What to do

Kernel update introducing get_recv_wqe(), which validates num_sge and copies the WQE into a kernel-private buffer before use - the same discipline the SRQ path already had. If Soft-RoCE is not actually needed (it usually is not on nodes with real ConnectX hardware), blacklisting rdma_rxe removes the entire rxe surface without a reboot and is the fastest real mitigation.

References