Peter Xu <[email protected]> writes: > Before registration of RDMA ranges, QEMU destination checks for validity of > current_addr no less than the target ramblock's start address. But it > didn't check for the upper bound to make sure the address is within the > size of the ramblock. Add it. > > Reported-by: Tristan (@TristanInSec) > Closes: https://gitlab.com/qemu-project/qemu/-/work_items/4007 > Reviewed-by: Jinpu Wang <[email protected]> > Signed-off-by: Peter Xu <[email protected]> > --- > migration/rdma.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/migration/rdma.c b/migration/rdma.c > index cf6688a4bc..d8953363fe 100644 > --- a/migration/rdma.c > +++ b/migration/rdma.c > @@ -3387,7 +3387,8 @@ int rdma_registration_handle(QEMUFile *f) > goto err; > } > block = &(rdma->local_ram_blocks.block[reg->current_index]); > - if (block->offset > reg->current_addr) { > + if (block->offset > reg->current_addr || > + block->offset + block->length <= reg->current_addr) { > error_report("rdma: bad register address for block %s" > " offset: %" PRIx64 " current_addr: %" PRIx64, > block->block_name, block->offset,
Reviewed-by: Fabiano Rosas <[email protected]>
