From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:43922) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1gX31K-0003c0-Ed for qemu-devel@nongnu.org; Wed, 12 Dec 2018 06:49:43 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1gX31J-00048x-JZ for qemu-devel@nongnu.org; Wed, 12 Dec 2018 06:49:42 -0500 Received: from mx1.redhat.com ([209.132.183.28]:34618) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1gX31J-00048O-CV for qemu-devel@nongnu.org; Wed, 12 Dec 2018 06:49:41 -0500 From: P J P Date: Wed, 12 Dec 2018 17:17:23 +0530 Message-Id: <20181212114726.24060-4-ppandit@redhat.com> In-Reply-To: <20181212114726.24060-1-ppandit@redhat.com> References: <20181212114726.24060-1-ppandit@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Subject: [Qemu-devel] [PATCH v1 3/6] pvrdma: check number of pages when creating rings List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Yuval Shaia Cc: Qemu Developers , Marcel Apfelbaum , Saar Amar , Li Qiang , Prasad J Pandit From: Prasad J Pandit When creating CQ/QP rings, an object can have up to PVRDMA_MAX_FAST_REG_PAGES=3D128 pages. Check 'npages' parameter to avoid excessive memory allocation or a null dereference. Reported-by: Li Qiang Signed-off-by: Prasad J Pandit --- hw/rdma/vmw/pvrdma_cmd.c | 11 +++++++++++ 1 file changed, 11 insertions(+) Update v1: move check before page dir/tbl map -> https://lists.gnu.org/archive/html/qemu-devel/2018-12/msg02257.html diff --git a/hw/rdma/vmw/pvrdma_cmd.c b/hw/rdma/vmw/pvrdma_cmd.c index 4f616d4177..e37fb18280 100644 --- a/hw/rdma/vmw/pvrdma_cmd.c +++ b/hw/rdma/vmw/pvrdma_cmd.c @@ -259,6 +259,11 @@ static int create_cq_ring(PCIDevice *pci_dev , Pvrdm= aRing **ring, int rc =3D -EINVAL; char ring_name[MAX_RING_NAME_SZ]; =20 + if (!nchunks || nchunks > PVRDMA_MAX_FAST_REG_PAGES) { + pr_dbg("invalid nchunks: %d\n", nchunks); + return rc; + } + pr_dbg("pdir_dma=3D0x%llx\n", (long long unsigned int)pdir_dma); dir =3D rdma_pci_dma_map(pci_dev, pdir_dma, TARGET_PAGE_SIZE); if (!dir) { @@ -371,6 +376,12 @@ static int create_qp_rings(PCIDevice *pci_dev, uint6= 4_t pdir_dma, char ring_name[MAX_RING_NAME_SZ]; uint32_t wqe_sz; =20 + if (!spages || spages > PVRDMA_MAX_FAST_REG_PAGES + || !rpages || rpages > PVRDMA_MAX_FAST_REG_PAGES) { + pr_dbg("invalid pages: %d, %d\n", spages, rpages); + return rc; + } + pr_dbg("pdir_dma=3D0x%llx\n", (long long unsigned int)pdir_dma); dir =3D rdma_pci_dma_map(pci_dev, pdir_dma, TARGET_PAGE_SIZE); if (!dir) { --=20 2.19.2