Re: [PATCH 0/4] RDMA/rxe: Fix u64 iova-overflow family in MR/ODP/RESP/MW paths

[Zhu Yanjun <yanjun.zhu@linux.dev>]

在 2026/5/21 8:39, Tymbark7372 写道:
> This series fixes a family of u64 overflow bugs in the rxe Soft-RoCE
> driver.  All four sites share one root cause: addition of an
> attacker-influenced iova/addr (u64) with an attacker-influenced
> length/resid (size_t/u32/int promoted to u64), without overflow
> check, leading to an OOB read/write primitive in the rxe responder
> workqueue.
> 
> I originally reported these to security@kernel.org.  Jason Gunthorpe
> confirmed that rxe and siw are development-only drivers without
> embargo handling and asked me to send patches publicly, so this
> series follows that direction.  security@kernel.org is intentionally
> not in Cc per Jason's instruction.
> 
> Patches:
> 
>    1/4: rxe_mr.c mr_check_range
>         The USER/MEM_REG case computes iova + length and compares to
>         mr->ibmr.iova + mr->ibmr.length.  Both additions wrap in u64.
>         Use check_add_overflow() for both ends.
> 
>    2/4: rxe_odp.c rxe_check_pagefault
>         Loop condition addr < iova + length wraps when iova is near
>         U64_MAX and length is positive.  Compute iova_end with
>         check_add_overflow() once and use it in the loop condition.
> 
>    3/4: rxe_resp.c duplicate_request
>         Third clause iova + resid > res->read.va_org + res->read.length
>         has u64 wrap on both sides.  Use check_add_overflow() for both
>         ends.  (Site A in check_rkey, also in rxe_resp.c, calls into
>         mr_check_range and is closed by patch 1.)
> 
>    4/4: rxe_mw.c rxe_check_bind_mw
>         Same wrap class as patch 1.  Found by sibling-site grep; not on
>         the OOB-write path of the three primary bugs but a
>         structurally-identical u64 wrap that would let an attacker bind
>         a memory window outside its parent MR's range.
> 
> Verification:
> 
> Each of the three primary sibling triggers (patches 1, 2, 3) has been
> exercised on v7.1.0-rc3 + KASAN in QEMU as the OOB-write case.
> Patches 1 and 3 produce a single-page-fault Oops in rxe_mr_copy after
> the wrap.  Patch 2 produces a single-page-fault Oops in
> rxe_odp_mr_copy.  All three are triggered by a single ibv_post_send
> from an unprivileged local user with /dev/infiniband/uverbs0 open.
> A working LPE exploit demonstrated end-to-end privilege escalation
> via the rxe_odp path under the verification config (KASAN dev-build,
> selinux=0, nokaslr).  Full PoC and writeup were attached to the
> original security@kernel.org submission.
> 
> After applying all four patches, the same triggers no longer fire;
> the wrap checks correctly reject the attacker iova.  Re-tested in the
> same QEMU+KASAN configuration.
> 
> The trigger PoCs are simple libibverbs programs (one per sibling)
> that I am happy to provide on request.
> 
> Fixes / stable:
> 
>    1/4: Fixes 8700e3e7c485 ("Soft RoCE driver"), v4.8+
>    2/4: Fixes 2fae67ab63db ("RDMA/rxe: Add support for Send/Recv/Write/Read with ODP"), v6.15+
>    3/4: Fixes 8700e3e7c485 ("Soft RoCE driver"), v4.8+
>    4/4: Fixes 8700e3e7c485 ("Soft RoCE driver"), v4.8+
> 
> Pre-f04d5b3d916c LTS branches carry the older wrap form
>    iova > mr->ibmr.iova + mr->ibmr.length - length
> instead of the current `iova + length > ...` shape.  Patches 1, 3, 4
> will need a backport variant for those branches; I can provide on
> request.
> 
> Tymbark7372 (4):
>    RDMA/rxe: Fix u64 iova+length overflow in mr_check_range
>    RDMA/rxe: Fix u64 iova+length overflow in rxe_check_pagefault
>    RDMA/rxe: Fix u64 iova+resid overflow in duplicate_request
>    RDMA/rxe: Fix u64 addr+length overflow in rxe_check_bind_mw

To be honest, please do not send the commits with the attachment.

Normally, use the command to send several commits: git send-email 
001xxx.patch 002xxx.patch 003xxx.patch ... --to xxx --to xxx

Zhu Yanjun

> 
>   drivers/infiniband/sw/rxe/rxe_mr.c   | 12 +++++++++---
>   drivers/infiniband/sw/rxe/rxe_odp.c  | 10 ++++++++--
>   drivers/infiniband/sw/rxe/rxe_resp.c | 11 ++++++++---
>   drivers/infiniband/sw/rxe/rxe_mw.c   | 11 ++++++++---
>   4 files changed, 33 insertions(+), 11 deletions(-)
> 
> --
> Tymbark7372 <tymbark7372@proton.me>