[PATCH 0/4] RDMA/rxe: Fix u64 iova-overflow family in MR/ODP/RESP/MW paths

[Tymbark7372 <tymbark7372@proton.me>]

This patchset fixes a family of u64 overflow bugs in the rxe Soft-RoCE
driver.  All four sites share one root cause: addition of an
attacker-influenced iova/addr (u64) with an attacker-influenced
length/resid (size_t/u32/int promoted to u64), without overflow
check, leading to an OOB read/write primitive in the rxe responder
workqueue.

I originally reported these to security@kernel.org.  Jason Gunthorpe
confirmed that rxe and siw are development-only drivers without
embargo handling and asked me to send patches publicly, so I'm
posting here per his direction.  security@kernel.org is intentionally
not in Cc per Jason's instruction.

This is a resend of the patches I sent earlier today as attachments.
Zhu Yanjun pointed out attachments aren't the convention and asked
for inline format via git send-email.

Patches:

  1/4: rxe_mr.c mr_check_range
       The USER/MEM_REG case computes iova + length and compares to
       mr->ibmr.iova + mr->ibmr.length.  Both additions wrap in u64.
       Use check_add_overflow() for both ends.

  2/4: rxe_odp.c rxe_check_pagefault
       Loop condition addr < iova + length wraps when iova is near
       U64_MAX and length is positive.  Compute iova_end with
       check_add_overflow() once and use it in the loop condition.

  3/4: rxe_resp.c duplicate_request
       Third clause iova + resid > res->read.va_org + res->read.length
       has u64 wrap on both sides.  Use check_add_overflow() for both
       ends.  (Site A in check_rkey, also in rxe_resp.c, calls into
       mr_check_range and is closed by patch 1.)

  4/4: rxe_mw.c rxe_check_bind_mw
       Same wrap class as patch 1.  Found by sibling-site grep; not on
       the OOB-write path of the three primary bugs but a
       structurally-identical u64 wrap that would let an attacker bind
       a memory window outside its parent MR's range.

Verification:

Each of the three primary sibling triggers (patches 1, 2, 3) has been
exercised on v7.1.0-rc3 + KASAN in QEMU as the OOB-write case.
Patches 1 and 3 produce a single-page-fault Oops in rxe_mr_copy after
the wrap.  Patch 2 produces a single-page-fault Oops in
rxe_odp_mr_copy.  All three are triggered by a single ibv_post_send
from an unprivileged local user with /dev/infiniband/uverbs0 open.
A working LPE exploit demonstrated end-to-end privilege escalation
via the rxe_odp path under the verification config (KASAN dev-build,
selinux=0, nokaslr).  Full PoC and writeup were attached to the
original security@kernel.org submission.

After applying all four patches, the same triggers no longer fire;
the wrap checks correctly reject the attacker iova.  Re-tested in the
same QEMU+KASAN configuration.

The trigger PoCs are simple libibverbs programs (one per sibling)
that I am happy to provide on request.

Fixes / stable:

  1/4: Fixes 8700e3e7c485 ("Soft RoCE driver"), v4.8+
  2/4: Fixes 2fae67ab63db ("RDMA/rxe: Add support for Send/Recv/Write/Read with ODP"), v6.15+
  3/4: Fixes 8700e3e7c485 ("Soft RoCE driver"), v4.8+
  4/4: Fixes 8700e3e7c485 ("Soft RoCE driver"), v4.8+

Pre-f04d5b3d916c LTS branches carry the older wrap form
  iova > mr->ibmr.iova + mr->ibmr.length - length
instead of the current `iova + length > ...` shape.  Patches 1, 3, 4
will need a backport variant for those branches; I can provide on
request.

Tymbark7372 (4):
  RDMA/rxe: Fix u64 iova+length overflow in mr_check_range
  RDMA/rxe: Fix u64 iova+length overflow in rxe_check_pagefault
  RDMA/rxe: Fix u64 iova+resid overflow in duplicate_request
  RDMA/rxe: Fix u64 addr+length overflow in rxe_check_bind_mw

 drivers/infiniband/sw/rxe/rxe_mr.c   | 12 +++++++++---
 drivers/infiniband/sw/rxe/rxe_odp.c  | 10 ++++++++--
 drivers/infiniband/sw/rxe/rxe_resp.c | 11 ++++++++---
 drivers/infiniband/sw/rxe/rxe_mw.c   | 11 ++++++++---
 4 files changed, 33 insertions(+), 11 deletions(-)

--
2.43.0