providers/rxe: Avoid 32-bit overflow when validating inline send length

[ Upstream commit 665294c5a0dfde1b5e8018a065346a1e23bc6ec7 ]

post_one_send() accumulates the total length of all SGEs of a send work
request into an "unsigned int" before passing it to validate_send_wr(),
which rejects inline work requests whose length exceeds sq->max_inline.

Because each ibv_sge.length is a 32-bit value and the number of SGEs is
only bounded by sq->max_sge, the sum can wrap around 2^32. A caller
posting an IBV_SEND_INLINE work request with several SGEs whose real
total exceeds 4 GiB but whose truncated 32-bit sum is <= max_inline
passes the check. init_send_wqe() then copies each SGE into
wqe->dma.inline_data using its real length, writing past the inline area
of the WQE in the mapped send queue and corrupting adjacent WQEs.

Accumulate the length in a 64-bit variable and validate the untruncated
value. Once validate_send_wr() accepts an inline request its length is
<= max_inline, so the subsequent narrowing to the 32-bit dma.length
field is safe.

Fixes: 311e6f0b4 ("Initial version librxe-1.0.0")
Signed-off-by: Yi Liu <liuy22@mails.tsinghua.edu.cn>
Signed-off-by: Nicolas Morey <nmorey@suse.com>