Re: [PATCH v2 08/10] migration/rdma: Sanity check RDMA_CONTROL_REGISTER_REQUEST chunks

Peter Xu <[email protected]> writes:

> The value received on wire for head.chunks when registering new RDMA
> regions is not correctly checked.  Logically the value can still make
> ram_chunk_start() (of ram_chunk_end()) to overflow, having a result pointer
> very small, smaller than RDMALocalBlock.local_host_addr.
>
> Add the sanity check.
>
> Reported-by: Tristan (@TristanInSec)
> Closes: https://gitlab.com/qemu-project/qemu/-/work_items/4011
> Reviewed-by: Jinpu Wang <[email protected]>
> Signed-off-by: Peter Xu <[email protected]>
> ---
>  migration/rdma.c | 10 +++++++++-
>  1 file changed, 9 insertions(+), 1 deletion(-)
>
> diff --git a/migration/rdma.c b/migration/rdma.c
> index f7356e759f..cf6688a4bc 100644
> --- a/migration/rdma.c
> +++ b/migration/rdma.c
> @@ -3369,7 +3369,7 @@ int rdma_registration_handle(QEMUFile *f)
>              }
>  
>              for (int count = 0; count < head.repeat; count++) {
> -                uint64_t chunk;
> +                uint64_t chunk, chunk_sum;
>                  uint8_t *chunk_start, *chunk_end;
>  
>                  reg = &registers[count];
> @@ -3399,6 +3399,14 @@ int rdma_registration_handle(QEMUFile *f)
>                  chunk = ram_chunk_index(block->local_host_addr,
>                                          (uint8_t *) host_addr);
>                  chunk_start = ram_chunk_start(block, chunk);
> +                if (uadd64_overflow(chunk, reg->chunks, &chunk_sum) ||
> +                    chunk_sum >= block->nb_chunks) {
> +                    error_report("%s: head.chunks contains illegal value"
> +                                 " (chunk=%"PRIu64", chunks=%"PRIu64", "
> +                                 "nb_chunks=%d)", __func__, chunk,
> +                                 reg->chunks, block->nb_chunks);
> +                    goto err;
> +                }
>                  chunk_end = ram_chunk_end(block, chunk + reg->chunks);
>                  /* avoid "-Waddress-of-packed-member" warning */
>                  uint32_t tmp_rkey = 0;

Reviewed-by: Fabiano Rosas <[email protected]>