Commit 0e68373c authored by Prasad J Pandit's avatar Prasad J Pandit Committed by Marcel Apfelbaum
Browse files

rdma: check num_sge does not exceed MAX_SGE 



rdma back-end has scatter/gather array ibv_sge[MAX_SGE=4] set
to have 4 elements. A guest could send a 'PvrdmaSqWqe' ring element
with 'num_sge' set to > MAX_SGE, which may lead to OOB access issue.
Add check to avoid it.

Reported-by: default avatarSaar Amar <saaramar5@gmail.com>
Signed-off-by: default avatarPrasad J Pandit <pjp@fedoraproject.org>
Reviewed-by: default avatarYuval Shaia <yuval.shaia@oracle.com>
Signed-off-by: default avatarMarcel Apfelbaum <marcel.apfelbaum@gmail.com>
parent cce64861

hw/rdma/rdma_backend.c

+6 −6
Original line number Diff line number Diff line
@@ -476,9 +476,9 @@ void rdma_backend_post_send(RdmaBackendDev *backend_dev, 
    }



    pr_dbg("num_sge=%d\n", num_sge);

    if (!num_sge) {

        pr_dbg("num_sge=0\n");

        complete_work(IBV_WC_GENERAL_ERR, VENDOR_ERR_NO_SGE, ctx);

    if (!num_sge || num_sge > MAX_SGE) {

        pr_dbg("invalid num_sge=%d\n", num_sge);

        complete_work(IBV_WC_GENERAL_ERR, VENDOR_ERR_INV_NUM_SGE, ctx);

        return;

    }
@@ -603,9 +603,9 @@ void rdma_backend_post_recv(RdmaBackendDev *backend_dev, 
    }



    pr_dbg("num_sge=%d\n", num_sge);

    if (!num_sge) {

        pr_dbg("num_sge=0\n");

        complete_work(IBV_WC_GENERAL_ERR, VENDOR_ERR_NO_SGE, ctx);

    if (!num_sge || num_sge > MAX_SGE) {

        pr_dbg("invalid num_sge=%d\n", num_sge);

        complete_work(IBV_WC_GENERAL_ERR, VENDOR_ERR_INV_NUM_SGE, ctx);

        return;

    }