From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:37886) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YumdE-0005gZ-0a for qemu-devel@nongnu.org; Tue, 19 May 2015 14:52:51 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1YumdA-0005Uo-K6 for qemu-devel@nongnu.org; Tue, 19 May 2015 14:52:47 -0400 Received: from e39.co.us.ibm.com ([32.97.110.160]:60296) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YumdA-0005Uf-9F for qemu-devel@nongnu.org; Tue, 19 May 2015 14:52:44 -0400 Received: from /spool/local by e39.co.us.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Tue, 19 May 2015 12:52:43 -0600 Received: from b01cxnp23033.gho.pok.ibm.com (b01cxnp23033.gho.pok.ibm.com [9.57.198.28]) by d01dlp02.pok.ibm.com (Postfix) with ESMTP id ECEFD6E8055 for ; Tue, 19 May 2015 14:44:21 -0400 (EDT) Received: from d01av02.pok.ibm.com (d01av02.pok.ibm.com [9.56.224.216]) by b01cxnp23033.gho.pok.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id t4JIqXQI61800564 for ; Tue, 19 May 2015 18:52:33 GMT Received: from d01av02.pok.ibm.com (localhost [127.0.0.1]) by d01av02.pok.ibm.com (8.14.4/8.14.4/NCO v10.0 AVout) with ESMTP id t4JIqW51031505 for ; Tue, 19 May 2015 14:52:32 -0400 Message-ID: <555B867A.2080906@linux.vnet.ibm.com> Date: Tue, 19 May 2015 13:52:42 -0500 From: "Michael R. Hines" MIME-Version: 1.0 References: <1429545445-28216-1-git-send-email-dgilbert@redhat.com> <1429545445-28216-11-git-send-email-dgilbert@redhat.com> In-Reply-To: <1429545445-28216-11-git-send-email-dgilbert@redhat.com> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] [PATCH 10/10] Sanity check RDMA remote data List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: "Dr. David Alan Gilbert (git)" , qemu-devel@nongnu.org Cc: amit.shah@redhat.com, arei.gonglei@huawei.com, mrhines@us.ibm.com, quintela@redhat.com On 04/20/2015 10:57 AM, Dr. David Alan Gilbert (git) wrote: > From: "Dr. David Alan Gilbert" > > Perform some basic (but probably not complete) sanity checking on > requests from the RDMA source. > > Signed-off-by: Dr. David Alan Gilbert > --- > migration/rdma.c | 30 ++++++++++++++++++++++++++++++ > 1 file changed, 30 insertions(+) > > diff --git a/migration/rdma.c b/migration/rdma.c > index 36b78dc..0c9d446 100644 > --- a/migration/rdma.c > +++ b/migration/rdma.c > @@ -2940,6 +2940,13 @@ static int qemu_rdma_registration_handle(QEMUFile *f, void *opaque) > trace_qemu_rdma_registration_handle_compress(comp->length, > comp->block_idx, > comp->offset); > + if (comp->block_idx >= rdma->local_ram_blocks.nb_blocks) { > + error_report("rdma: 'compress' bad block index %u (vs %d)", > + (unsigned int)comp->block_idx, > + rdma->local_ram_blocks.nb_blocks); > + ret = -EIO; > + break; > + } > block = &(rdma->local_ram_blocks.block[comp->block_idx]); > > host_addr = block->local_host_addr + > @@ -3028,8 +3035,23 @@ static int qemu_rdma_registration_handle(QEMUFile *f, void *opaque) > trace_qemu_rdma_registration_handle_register_loop(count, > reg->current_index, reg->key.current_addr, reg->chunks); > > + if (reg->current_index >= rdma->local_ram_blocks.nb_blocks) { > + error_report("rdma: 'register' bad block index %u (vs %d)", > + (unsigned int)reg->current_index, > + rdma->local_ram_blocks.nb_blocks); > + ret = -ENOENT; > + break; > + } > block = &(rdma->local_ram_blocks.block[reg->current_index]); > if (block->is_ram_block) { > + if (block->offset > reg->key.current_addr) { > + error_report("rdma: bad register address for block %s" > + " offset: %" PRIx64 " current_addr: %" PRIx64, > + block->block_name, block->offset, > + reg->key.current_addr); > + ret = -ERANGE; > + break; > + } > host_addr = (block->local_host_addr + > (reg->key.current_addr - block->offset)); > chunk = ram_chunk_index(block->local_host_addr, > @@ -3038,6 +3060,14 @@ static int qemu_rdma_registration_handle(QEMUFile *f, void *opaque) > chunk = reg->key.chunk; > host_addr = block->local_host_addr + > (reg->key.chunk * (1UL << RDMA_REG_CHUNK_SHIFT)); > + /* Check for particularly bad chunk value */ > + if (host_addr < (void *)block->local_host_addr) { > + error_report("rdma: bad chunk for block %s" > + " chunk: %" PRIx64, > + block->block_name, reg->key.chunk); > + ret = -ERANGE; > + break; > + } > } > chunk_start = ram_chunk_start(block, chunk); > chunk_end = ram_chunk_end(block, chunk + reg->chunks); Reviewed-by: Michael R. Hines