Commit 6f1484ed authored by Isaku Yamahata's avatar Isaku Yamahata Committed by Anthony Liguori
Browse files

rdma: validate RDMAControlHeader::len 



RMDAControlHeader::len is provided from remote, so validate it.

Reviewed-by: default avatarOrit Wasserman <owasserm@redhat.com>
Reviewed-by: default avatarMichael R. Hines <mrhines@us.ibm.com>
Signed-off-by: default avatarIsaku Yamahata <yamahata@private.email.ne.jp>
Signed-off-by: default avatarMichael R. Hines <mrhines@us.ibm.com>
Message-id: 1376078746-24948-3-git-send-email-mrhines@linux.vnet.ibm.com
Signed-off-by: default avatarAnthony Liguori <aliguori@us.ibm.com>
parent 885e8f98

migration-rdma.c

+5 −0
Original line number Diff line number Diff line
@@ -1424,6 +1424,7 @@ static int qemu_rdma_post_send_control(RDMAContext *rdma, uint8_t *buf, 
     * The copy makes the RDMAControlHeader simpler to manipulate

     * for the time being.

     */

    assert(head->len <= RDMA_CONTROL_MAX_BUFFER - sizeof(*head));

    memcpy(wr->control, head, sizeof(RDMAControlHeader));

    control_to_network((void *) wr->control);
@@ -1504,6 +1505,10 @@ static int qemu_rdma_exchange_get_response(RDMAContext *rdma, 
                control_desc[head->type], head->type, head->len);

        return -EIO;

    }

    if (head->len > RDMA_CONTROL_MAX_BUFFER - sizeof(*head)) {

        fprintf(stderr, "too long length: %d\n", head->len);

        return -EINVAL;

    }



    return 0;

}