Re: [PATCH v2 09/10] migration/rdma: Sanity check upper bound of register MR address

Peter Xu <[email protected]> writes:

> Before registration of RDMA ranges, QEMU destination checks for validity of
> current_addr no less than the target ramblock's start address.  But it
> didn't check for the upper bound to make sure the address is within the
> size of the ramblock.  Add it.
>
> Reported-by: Tristan (@TristanInSec)
> Closes: https://gitlab.com/qemu-project/qemu/-/work_items/4007
> Reviewed-by: Jinpu Wang <[email protected]>
> Signed-off-by: Peter Xu <[email protected]>
> ---
>  migration/rdma.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/migration/rdma.c b/migration/rdma.c
> index cf6688a4bc..d8953363fe 100644
> --- a/migration/rdma.c
> +++ b/migration/rdma.c
> @@ -3387,7 +3387,8 @@ int rdma_registration_handle(QEMUFile *f)
>                      goto err;
>                  }
>                  block = &(rdma->local_ram_blocks.block[reg->current_index]);
> -                if (block->offset > reg->current_addr) {
> +                if (block->offset > reg->current_addr ||
> +                    block->offset + block->length <= reg->current_addr) {
>                      error_report("rdma: bad register address for block %s"
>                          " offset: %" PRIx64 " current_addr: %" PRIx64,
>                          block->block_name, block->offset,

Reviewed-by: Fabiano Rosas <[email protected]>