Peter Xu <[email protected]> writes: > The value received on wire for head.chunks when registering new RDMA > regions is not correctly checked. Logically the value can still make > ram_chunk_start() (of ram_chunk_end()) to overflow, having a result pointer > very small, smaller than RDMALocalBlock.local_host_addr. > > Add the sanity check. > > Reported-by: Tristan (@TristanInSec) > Closes: https://gitlab.com/qemu-project/qemu/-/work_items/4011 > Reviewed-by: Jinpu Wang <[email protected]> > Signed-off-by: Peter Xu <[email protected]> > --- > migration/rdma.c | 10 +++++++++- > 1 file changed, 9 insertions(+), 1 deletion(-) > > diff --git a/migration/rdma.c b/migration/rdma.c > index f7356e759f..cf6688a4bc 100644 > --- a/migration/rdma.c > +++ b/migration/rdma.c > @@ -3369,7 +3369,7 @@ int rdma_registration_handle(QEMUFile *f) > } > > for (int count = 0; count < head.repeat; count++) { > - uint64_t chunk; > + uint64_t chunk, chunk_sum; > uint8_t *chunk_start, *chunk_end; > > reg = ®isters[count]; > @@ -3399,6 +3399,14 @@ int rdma_registration_handle(QEMUFile *f) > chunk = ram_chunk_index(block->local_host_addr, > (uint8_t *) host_addr); > chunk_start = ram_chunk_start(block, chunk); > + if (uadd64_overflow(chunk, reg->chunks, &chunk_sum) || > + chunk_sum >= block->nb_chunks) { > + error_report("%s: head.chunks contains illegal value" > + " (chunk=%"PRIu64", chunks=%"PRIu64", " > + "nb_chunks=%d)", __func__, chunk, > + reg->chunks, block->nb_chunks); > + goto err; > + } > chunk_end = ram_chunk_end(block, chunk + reg->chunks); > /* avoid "-Waddress-of-packed-member" warning */ > uint32_t tmp_rkey = 0;
Reviewed-by: Fabiano Rosas <[email protected]>
