migration/rdma: Sanity check compress request ranges
The offset/length ranges are not sanity checked in RDMA requests, add the checks. Reported-by: Tristan (@TristanInSec) Closes: https://gitlab.com/qemu-project/qemu/-/work_items/4005 Reviewed-by: Jinpu Wang <jinpu.wang@cloud.ionos.com> Signed-off-by: Peter Xu <peterx@redhat.com> Reviewed-by: Fabiano Rosas <farosas@suse.de> Reviewed-by: Jack Wang <jinpu.wang@cloud.ionos.com> Signed-off-by: Fabiano Rosas <farosas@suse.de>
Peter Xu committed
Aug 20, 2026 at 16:03 UTC
636d0cd59bd575329ed3524d014bde5cc287ddea
1 file changed
+25
-1
migration/rdma.c
+25
-1
@@ -3198,6 +3198,28 @@ static int dest_ram_sort_func(const void *a, const void *b)
3198
return (a_index < b_index) ? -1 : (a_index != b_index);
3199
}
3200
3201
+static bool rdma_compress_range_check(RDMALocalBlock *block,
3202
+ RDMACompress *comp)
3203
+{
3204
+ uint64_t block_end = block->offset + block->length;
3205
+ uint64_t comp_end;
3206
+
3207
+ if (uadd64_overflow(comp->offset, comp->length, &comp_end)) {
3208
+ goto fail;
3209
+ }
3210
+
3211
+ if (comp->offset < block->offset || comp_end > block_end) {
3212
+ goto fail;
3213
+ }
3214
+
3215
+ return true;
3216
+fail:
3217
+ error_report("%s: compress request range outside range"
3218
+ " (block=%s, offset=%"PRIu64", length=%"PRIu64")",
3219
+ __func__, block->block_name, comp->offset, comp->length);
3220
+ return false;
3221
+}
3222
+
3223
/*
3224
* During each iteration of the migration, we listen for instructions
3225
* by the source VM to perform dynamic page registrations before they
@@ -3277,7 +3299,9 @@ int rdma_registration_handle(QEMUFile *f)
3299
goto err;
3300
}
3301
block = &(rdma->local_ram_blocks.block[comp->block_idx]);
3280
-
3302
+ if (!rdma_compress_range_check(block, comp)) {
3303
+ goto err;
3304
+ }
3305
host_addr = block->local_host_addr +
3306
(comp->offset - block->offset);
3307
if (comp->value) {