[PATCH 3/4] RDMA/rxe: Fix u64 iova+resid overflow in duplicate_request

[Tymbark7372 <tymbark7372@proton.me>]

In the duplicate-READ handling of duplicate_request(), the third
clause of the bound check computes (iova + resid) and compares it
with (res->read.va_org + res->read.length).  iova is u64, resid is
u32 promoted to u64; the addition wraps modulo 2^64.  An attacker
setting reth_va = 0xFFFFFFFFFFFFFC00 and reth_len = 0x400 causes the
left-hand sum to wrap to 0 while the right-hand sum stays small, so
the check passes and res->read.va is later set to the wrap address on
replay.

Downstream of either bound check site in rxe_resp.c, read_reply
calls rxe_mr_copy() with the wrap iova, which re-traverses
mr_check_range() and rxe_mr_iova_to_index(), and rxe_mr_copy_xarray()
OOB-derefs page_info[huge_idx].  The primitive is the same as patch
1 of this series, reached via the RDMA_READ path on a duplicate
(retransmitted) request.

Use check_add_overflow() on both sides of the comparison.

Reproduced on v7.1.0-rc3 + KASAN with a single
ibv_post_send(IBV_WR_RDMA_READ) followed by a retransmit of the
identical packet, with the wrap iova above.  WARN at
rxe_mr_iova_to_index+0x135 followed by page-fault Oops in
rxe_mr_copy+0x20d on the READ path (rxe_receiver+0x3c70, distinct
from the WRITE offset rxe_receiver+0x6aa8 that the patch 1 trigger
reaches).

Fixes: 8700e3e7c485 ("Soft RoCE driver")
Cc: stable@vger.kernel.org # v4.8+
Reported-by: Tymbark7372 <tymbark7372@proton.me>
Signed-off-by: Tymbark7372 <tymbark7372@proton.me>
Assisted-by: Claude:claude-opus-4-7
---
 drivers/infiniband/sw/rxe/rxe_resp.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c
--- a/drivers/infiniband/sw/rxe/rxe_resp.c
+++ b/drivers/infiniband/sw/rxe/rxe_resp.c
@@ -1356,11 +1356,16 @@ static enum resp_states duplicate_request(struct rxe_qp *qp,
 			 */
 			u64 iova = reth_va(pkt);
 			u32 resid = reth_len(pkt);
+			u64 va_end_orig, va_end_new;

-			if (iova < res->read.va_org ||
+			if (check_add_overflow(res->read.va_org,
+					       (u64)res->read.length,
+					       &va_end_orig) ||
+			    check_add_overflow(iova, (u64)resid,
+					       &va_end_new) ||
+			    iova < res->read.va_org ||
 			    resid > res->read.length ||
-			    (iova + resid) > (res->read.va_org +
-					      res->read.length)) {
+			    va_end_new > va_end_orig) {
 				rc = RESPST_CLEANUP;
 				goto out;
 			}
--
2.43.0