From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:56715) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZAFR9-0007uE-Sz for qemu-devel@nongnu.org; Wed, 01 Jul 2015 06:40:19 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ZAFR8-0002R1-HK for qemu-devel@nongnu.org; Wed, 01 Jul 2015 06:40:15 -0400 Received: from mx1.redhat.com ([209.132.183.28]:37017) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZAFR8-0002Qr-9f for qemu-devel@nongnu.org; Wed, 01 Jul 2015 06:40:14 -0400 Received: from int-mx14.intmail.prod.int.phx2.redhat.com (int-mx14.intmail.prod.int.phx2.redhat.com [10.5.11.27]) by mx1.redhat.com (Postfix) with ESMTPS id E595EC7859 for ; Wed, 1 Jul 2015 10:40:13 +0000 (UTC) From: Juan Quintela Date: Wed, 1 Jul 2015 12:39:36 +0200 Message-Id: <1435747190-18017-13-git-send-email-quintela@redhat.com> In-Reply-To: <1435747190-18017-1-git-send-email-quintela@redhat.com> References: <1435747190-18017-1-git-send-email-quintela@redhat.com> Subject: [Qemu-devel] [PULL 12/26] Sanity check RDMA remote data List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: amit.shah@redhat.com, "Dr. David Alan Gilbert" From: "Dr. David Alan Gilbert" Perform some basic (but probably not complete) sanity checking on requests from the RDMA source. Signed-off-by: Dr. David Alan Gilbert Reviewed-by: Michael R. Hines Signed-off-by: Juan Quintela --- migration/rdma.c | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/migration/rdma.c b/migration/rdma.c index 73844a3..73a79be 100644 --- a/migration/rdma.c +++ b/migration/rdma.c @@ -2992,6 +2992,13 @@ static int qemu_rdma_registration_handle(QEMUFile *f, void *opaque) trace_qemu_rdma_registration_handle_compress(comp->length, comp->block_idx, comp->offset); + if (comp->block_idx >= rdma->local_ram_blocks.nb_blocks) { + error_report("rdma: 'compress' bad block index %u (vs %d)", + (unsigned int)comp->block_idx, + rdma->local_ram_blocks.nb_blocks); + ret = -EIO; + break; + } block = &(rdma->local_ram_blocks.block[comp->block_idx]); host_addr = block->local_host_addr + @@ -3080,8 +3087,23 @@ static int qemu_rdma_registration_handle(QEMUFile *f, void *opaque) trace_qemu_rdma_registration_handle_register_loop(count, reg->current_index, reg->key.current_addr, reg->chunks); + if (reg->current_index >= rdma->local_ram_blocks.nb_blocks) { + error_report("rdma: 'register' bad block index %u (vs %d)", + (unsigned int)reg->current_index, + rdma->local_ram_blocks.nb_blocks); + ret = -ENOENT; + break; + } block = &(rdma->local_ram_blocks.block[reg->current_index]); if (block->is_ram_block) { + if (block->offset > reg->key.current_addr) { + error_report("rdma: bad register address for block %s" + " offset: %" PRIx64 " current_addr: %" PRIx64, + block->block_name, block->offset, + reg->key.current_addr); + ret = -ERANGE; + break; + } host_addr = (block->local_host_addr + (reg->key.current_addr - block->offset)); chunk = ram_chunk_index(block->local_host_addr, @@ -3090,6 +3112,14 @@ static int qemu_rdma_registration_handle(QEMUFile *f, void *opaque) chunk = reg->key.chunk; host_addr = block->local_host_addr + (reg->key.chunk * (1UL << RDMA_REG_CHUNK_SHIFT)); + /* Check for particularly bad chunk value */ + if (host_addr < (void *)block->local_host_addr) { + error_report("rdma: bad chunk for block %s" + " chunk: %" PRIx64, + block->block_name, reg->key.chunk); + ret = -ERANGE; + break; + } } chunk_start = ram_chunk_start(block, chunk); chunk_end = ram_chunk_end(block, chunk + reg->chunks); -- 2.4.3