Before registration of RDMA ranges, QEMU destination checks for validity of current_addr no less than the target ramblock's start address. But it didn't check for the upper bound to make sure the address is within the size of the ramblock. Add it.
Reported-by: Tristan (@TristanInSec) Closes: https://gitlab.com/qemu-project/qemu/-/work_items/4007 Reviewed-by: Jinpu Wang <[email protected]> Signed-off-by: Peter Xu <[email protected]> --- migration/rdma.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/migration/rdma.c b/migration/rdma.c index cf6688a4bc..d8953363fe 100644 --- a/migration/rdma.c +++ b/migration/rdma.c @@ -3387,7 +3387,8 @@ int rdma_registration_handle(QEMUFile *f) goto err; } block = &(rdma->local_ram_blocks.block[reg->current_index]); - if (block->offset > reg->current_addr) { + if (block->offset > reg->current_addr || + block->offset + block->length <= reg->current_addr) { error_report("rdma: bad register address for block %s" " offset: %" PRIx64 " current_addr: %" PRIx64, block->block_name, block->offset, -- 2.54.0
