[PATCH 2/4] RDMA/rxe: Fix u64 iova+length overflow in rxe_check_pagefault

[Tymbark7372 <tymbark7372@proton.me>]

rxe_check_pagefault() loops with the condition
"addr < iova + length" where iova is u64 and length is int.  The
addition is promoted to u64 and wraps modulo 2^64 when iova is near
U64_MAX.  With iova = 0xFFFFFFFFFFFFFC00 and length = 0x400 the sum
is 0; the loop body never executes; the function returns
need_fault = false; and the prefetch-fault check is bypassed.

Control then enters __rxe_odp_mr_copy(), which calls
rxe_odp_iova_to_index() on the wrap iova to obtain a huge index, and
dereferences umem_odp->map.pfn_list[huge_idx], an attacker-controlled
out-of-bounds slot.  hmm_pfn_to_page() resolves the read value to an
attacker-chosen struct page, after which memcpy lands at
kmap_local_page(that_page) + offset, yielding arbitrary kernel write.

Reject any iova/length pair that overflows by computing iova_end with
check_add_overflow() once before the loop and using it as the loop
bound.  A negative length is also rejected to avoid u64 promotion
masking the case.

Reproduced on v7.1.0-rc3 + KASAN with a single RDMA_WRITE against an
ODP-flagged MR; the kernel oopses in rxe_odp_mr_copy+0x205 with
RSI=0xfffffffffffffc00 (the wrap iova) and R13 holding the resolved
wrapped index.  A working LPE chain that uses this OOB primitive to
overwrite cred_jar slab pages was demonstrated end-to-end on the same
verification kernel.

Fixes: 2fae67ab63db ("RDMA/rxe: Add support for Send/Recv/Write/Read with ODP")
Cc: stable@vger.kernel.org # v6.15+
Reported-by: Tymbark7372 <tymbark7372@proton.me>
Signed-off-by: Tymbark7372 <tymbark7372@proton.me>
Assisted-by: Claude:claude-opus-4-7
---
 drivers/infiniband/sw/rxe/rxe_odp.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/infiniband/sw/rxe/rxe_odp.c b/drivers/infiniband/sw/rxe/rxe_odp.c
--- a/drivers/infiniband/sw/rxe/rxe_odp.c
+++ b/drivers/infiniband/sw/rxe/rxe_odp.c
@@ -127,13 +127,19 @@ static inline bool rxe_check_pagefault(struct ib_umem_odp *umem_odp, u64 iova,
 				       int length)
 {
 	bool need_fault = false;
-	u64 addr;
+	u64 addr, iova_end;
 	int idx;

+	if (length < 0 ||
+	    check_add_overflow(iova, (u64)length, &iova_end)) {
+		/* let the pagefault path reject a bogus iova/length */
+		return true;
+	}
+
 	addr = iova & (~(BIT(umem_odp->page_shift) - 1));

 	/* Skim through all pages that are to be accessed. */
-	while (addr < iova + length) {
+	while (addr < iova_end) {
 		idx = (addr - ib_umem_start(umem_odp)) >> umem_odp->page_shift;

 		if (!(umem_odp->map.pfn_list[idx] & HMM_PFN_VALID)) {
--
2.43.0