migration/rdma: Sanity check RDMA_CONTROL_REGISTER_REQUEST chunks
The value received on wire for head.chunks when registering new RDMA regions is not correctly checked. Logically the value can still make ram_chunk_start() (of ram_chunk_end()) to overflow, having a result pointer very small, smaller than RDMALocalBlock.local_host_addr. Add the sanity check. Reported-by: Tristan (@TristanInSec) Closes: https://gitlab.com/qemu-project/qemu/-/work_items/4011 Reviewed-by: Jinpu Wang <jinpu.wang@cloud.ionos.com> Signed-off-by: Peter Xu <peterx@redhat.com> Reviewed-by: Fabiano Rosas <farosas@suse.de> Signed-off-by: Fabiano Rosas <farosas@suse.de>
Peter Xu committed
Aug 20, 2026 at 16:03 UTC
68f1fc45512a642234ca97361a822071867653e1
1 file changed
+9
-1
migration/rdma.c
+9
-1
@@ -3369,7 +3369,7 @@ int rdma_registration_handle(QEMUFile *f)
3369
}
3370
3371
for (int count = 0; count < head.repeat; count++) {
3372
- uint64_t chunk;
3372
+ uint64_t chunk, chunk_sum;
3373
uint8_t *chunk_start, *chunk_end;
3374
3375
reg = ®isters[count];
@@ -3399,6 +3399,14 @@ int rdma_registration_handle(QEMUFile *f)
3399
chunk = ram_chunk_index(block->local_host_addr,
3400
(uint8_t *) host_addr);
3401
chunk_start = ram_chunk_start(block, chunk);
3402
+ if (uadd64_overflow(chunk, reg->chunks, &chunk_sum) ||
3403
+ chunk_sum >= block->nb_chunks) {
3404
+ error_report("%s: head.chunks contains illegal value"
3405
+ " (chunk=%"PRIu64", chunks=%"PRIu64", "
3406
+ "nb_chunks=%d)", __func__, chunk,
3407
+ reg->chunks, block->nb_chunks);
3408
+ goto err;
3409
+ }
3410
chunk_end = ram_chunk_end(block, chunk + reg->chunks);
3411
/* avoid "-Waddress-of-packed-member" warning */
3412
uint32_t tmp_rkey = 0;