RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access

From: Gang Yan <[email protected]>

mr_check_range() validates that [iova, iova+length) falls within the registered MR range using wraparound-prone arithmetic:

    if (iova < mr->ibmr.iova ||
        iova + length > mr->ibmr.iova + mr->ibmr.length)

A remote peer can craft an RDMA-Write/Read RETH so that iova + length wraps to 0 (e.g. iova=0xfffffffffffffff8, length=8), bypassing the check. rxe_mr_iova_to_index() then computes a huge index (int idx, only guarded by WARN_ON) and rxe_mr_copy_xarray() dereferences mr->page_info[huge], causing an out-of-bounds read/write and a kernel oops that is triggerable by an unauthenticated remote peer.

Rewrite the check in overflow-safe form; the first two clauses guarantee that the subsequent subtractions do not underflow:

    if (iova < mr->ibmr.iova ||
        length > mr->ibmr.length ||
        iova - mr->ibmr.iova > mr->ibmr.length - length)

With the fix, mr_check_range() returns -EINVAL for the crafted iova and the responder reports REMOTE_ACCESS_ERROR instead of triggering the OOB.

---
Changelog:
v3:
- rebase on rdma/for-next
- CC to stable maillist
v2:
- Add Yanjun's reviewed-by tag as he suggested.
v1:
- The reproducer is attached in v1 thread.

---
 drivers/infiniband/sw/rxe/rxe_mr.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

index 875eceb55fdf..71d9ea477289 100644
@@ -33,7 +33,8 @@ int mr_check_range(struct rxe_mr *mr, u64 iova, size_t length)
 	case IB_MR_TYPE_USER:
 	case IB_MR_TYPE_MEM_REG:
 		if (iova < mr->ibmr.iova ||
-		    iova + length > mr->ibmr.iova + mr->ibmr.length) {
+		    length > mr->ibmr.length ||
+		    iova - mr->ibmr.iova > mr->ibmr.length - length) {
 			rxe_dbg_mr(mr, "iova/length out of range\n");
 			return -EINVAL;
 		}

2.43.0

Thank you for the patch. We independently identified the same issue and have reviewed, and tested this patch using our two-VM PoC for OOB read/write.

The patch correctly rejects the wrapped requests and prevents the out-of-bounds read/write and host crash.

Kind regards,
Shukai Ni and Jo Van Bulck
DistriNet, KU Leuven

Applied, thanks!

[1/1] RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access

      https://git.kernel.org/rdma/rdma/c/d10e2a08799e85

Best regards,

Leon Romanovsky <[email protected]>