migration/rdma: Sanity check upper bound of register MR address
Before registration of RDMA ranges, QEMU destination checks for validity of current_addr no less than the target ramblock's start address. But it didn't check for the upper bound to make sure the address is within the size of the ramblock. Add it. Reported-by: Tristan (@TristanInSec) Closes: https://gitlab.com/qemu-project/qemu/-/work_items/4007 Reviewed-by: Jinpu Wang <jinpu.wang@cloud.ionos.com> Signed-off-by: Peter Xu <peterx@redhat.com> Reviewed-by: Fabiano Rosas <farosas@suse.de> Reviewed-by: Jack Wang <jinpu.wang@cloud.ionos.com> Signed-off-by: Fabiano Rosas <farosas@suse.de>
Peter Xu committed
Aug 20, 2026 at 16:03 UTC
962cc99d83a3a74274f070a5032f08b9d539ca50
1 file changed
+2
-1
migration/rdma.c
+2
-1
@@ -3387,7 +3387,8 @@ int rdma_registration_handle(QEMUFile *f)
3387
goto err;
3388
}
3389
block = &(rdma->local_ram_blocks.block[reg->current_index]);
3390
- if (block->offset > reg->current_addr) {
3390
+ if (block->offset > reg->current_addr ||
3391
+ block->offset + block->length <= reg->current_addr) {
3392
error_report("rdma: bad register address for block %s"
3393
" offset: %" PRIx64 " current_addr: %" PRIx64,
3394
block->block_name, block->offset,