infiniband BestPgsz Overflow

Vulnerability analysis

When a process registers memory for RDMA, the kernel computes the largest hardware page size that can cover the region. On 32-bit systems, the virtual address argument is truncated from 64-bit to 32-bit, the sum of the region length and address can silently overflow, and a bitmask generation macro can overflow for lengths exceeding 4 GB. Any of these conditions causes an incorrect page size to be selected, which can result in the RDMA hardware performing DMA transfers against the wrong physical memory — a memory-corruption primitive. The fix widens the address parameter to 64-bit, adds an explicit overflow check that returns failure when the address-plus-length sum exceeds the representable range, and guards the bitmask computation so it does not overflow. This is reachable locally by any process that can open RDMA user-verbs device files; it does not require root, only access to the RDMA subsystem, and is most dangerous on 32-bit kernels with RDMA-capable hardware.