Before registration of RDMA ranges, QEMU destination checks for validity of current_addr no less than the target ramblock's start address. But it didn't check for the upper bound to make sure the address is within the size of the ramblock. Add it.
Reported-by: Tristan (@TristanInSec) Closes: https://gitlab.com/qemu-project/qemu/-/work_items/4007 Signed-off-by: Peter Xu <[email protected]> --- migration/rdma.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/migration/rdma.c b/migration/rdma.c index bbbc40ea3b..13dd60c11b 100644 --- a/migration/rdma.c +++ b/migration/rdma.c @@ -3389,7 +3389,8 @@ int rdma_registration_handle(QEMUFile *f) goto err; } block = &(rdma->local_ram_blocks.block[reg->current_index]); - if (block->offset > reg->current_addr) { + if (block->offset > reg->current_addr || + block->offset + block->length <= reg->current_addr) { error_report("rdma: bad register address for block %s" " offset: %" PRIx64 " current_addr: %" PRIx64, block->block_name, block->offset, -- 2.54.0
