|
 |
9ae3a8 |
From 036dba4d4b9a82507dafba8a365bf6e6bbf5b6e8 Mon Sep 17 00:00:00 2001
|
|
|
9ae3a8 |
Message-Id: <036dba4d4b9a82507dafba8a365bf6e6bbf5b6e8.1387382496.git.minovotn@redhat.com>
|
|
|
9ae3a8 |
In-Reply-To: <c5386144fbf09f628148101bc674e2421cdd16e3.1387382496.git.minovotn@redhat.com>
|
|
|
9ae3a8 |
References: <c5386144fbf09f628148101bc674e2421cdd16e3.1387382496.git.minovotn@redhat.com>
|
|
|
9ae3a8 |
From: Nigel Croxon <ncroxon@redhat.com>
|
|
|
9ae3a8 |
Date: Thu, 14 Nov 2013 22:53:04 +0100
|
|
|
9ae3a8 |
Subject: [PATCH 28/46] rdma: validate RDMAControlHeader::len
|
|
|
9ae3a8 |
|
|
|
9ae3a8 |
RH-Author: Nigel Croxon <ncroxon@redhat.com>
|
|
|
9ae3a8 |
Message-id: <1384469598-13137-29-git-send-email-ncroxon@redhat.com>
|
|
|
9ae3a8 |
Patchwork-id: 55709
|
|
|
9ae3a8 |
O-Subject: [RHEL7.0 PATCH 28/42] rdma: validate RDMAControlHeader::len
|
|
|
9ae3a8 |
Bugzilla: 1011720
|
|
|
9ae3a8 |
RH-Acked-by: Orit Wasserman <owasserm@redhat.com>
|
|
|
9ae3a8 |
RH-Acked-by: Amit Shah <amit.shah@redhat.com>
|
|
|
9ae3a8 |
RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
|
|
|
9ae3a8 |
|
|
|
9ae3a8 |
Bugzilla: 1011720
|
|
|
9ae3a8 |
https://bugzilla.redhat.com/show_bug.cgi?id=1011720
|
|
|
9ae3a8 |
|
|
|
9ae3a8 |
>From commit ID:
|
|
|
9ae3a8 |
commit 6f1484edadba57f2800dc04ae3527ee4b6dac7ef
|
|
|
9ae3a8 |
Author: Isaku Yamahata <yamahata@private.email.ne.jp>
|
|
|
9ae3a8 |
Date: Fri Aug 9 16:05:41 2013 -0400
|
|
|
9ae3a8 |
|
|
|
9ae3a8 |
rdma: validate RDMAControlHeader::len
|
|
|
9ae3a8 |
|
|
|
9ae3a8 |
RMDAControlHeader::len is provided from remote, so validate it.
|
|
|
9ae3a8 |
|
|
|
9ae3a8 |
Reviewed-by: Orit Wasserman <owasserm@redhat.com>
|
|
|
9ae3a8 |
Reviewed-by: Michael R. Hines <mrhines@us.ibm.com>
|
|
|
9ae3a8 |
Signed-off-by: Isaku Yamahata <yamahata@private.email.ne.jp>
|
|
|
9ae3a8 |
Signed-off-by: Michael R. Hines <mrhines@us.ibm.com>
|
|
|
9ae3a8 |
Message-id: 1376078746-24948-3-git-send-email-mrhines@linux.vnet.ibm.com
|
|
|
9ae3a8 |
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
|
|
|
9ae3a8 |
---
|
|
|
9ae3a8 |
migration-rdma.c | 5 +++++
|
|
|
9ae3a8 |
1 files changed, 5 insertions(+), 0 deletions(-)
|
|
|
9ae3a8 |
|
|
|
9ae3a8 |
Signed-off-by: Michal Novotny <minovotn@redhat.com>
|
|
|
9ae3a8 |
---
|
|
|
9ae3a8 |
migration-rdma.c | 5 +++++
|
|
|
9ae3a8 |
1 file changed, 5 insertions(+)
|
|
|
9ae3a8 |
|
|
|
9ae3a8 |
diff --git a/migration-rdma.c b/migration-rdma.c
|
|
|
9ae3a8 |
index 1412cde..140d930 100644
|
|
|
9ae3a8 |
--- a/migration-rdma.c
|
|
|
9ae3a8 |
+++ b/migration-rdma.c
|
|
|
9ae3a8 |
@@ -1424,6 +1424,7 @@ static int qemu_rdma_post_send_control(RDMAContext *rdma, uint8_t *buf,
|
|
|
9ae3a8 |
* The copy makes the RDMAControlHeader simpler to manipulate
|
|
|
9ae3a8 |
* for the time being.
|
|
|
9ae3a8 |
*/
|
|
|
9ae3a8 |
+ assert(head->len <= RDMA_CONTROL_MAX_BUFFER - sizeof(*head));
|
|
|
9ae3a8 |
memcpy(wr->control, head, sizeof(RDMAControlHeader));
|
|
|
9ae3a8 |
control_to_network((void *) wr->control);
|
|
|
9ae3a8 |
|
|
|
9ae3a8 |
@@ -1504,6 +1505,10 @@ static int qemu_rdma_exchange_get_response(RDMAContext *rdma,
|
|
|
9ae3a8 |
control_desc[head->type], head->type, head->len);
|
|
|
9ae3a8 |
return -EIO;
|
|
|
9ae3a8 |
}
|
|
|
9ae3a8 |
+ if (head->len > RDMA_CONTROL_MAX_BUFFER - sizeof(*head)) {
|
|
|
9ae3a8 |
+ fprintf(stderr, "too long length: %d\n", head->len);
|
|
|
9ae3a8 |
+ return -EINVAL;
|
|
|
9ae3a8 |
+ }
|
|
|
9ae3a8 |
|
|
|
9ae3a8 |
return 0;
|
|
|
9ae3a8 |
}
|
|
|
9ae3a8 |
--
|
|
|
9ae3a8 |
1.7.11.7
|
|
|
9ae3a8 |
|