[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH v2 11/12] Sanity check RDMA remote data
From: |
Dr. David Alan Gilbert (git) |
Subject: |
[Qemu-devel] [PATCH v2 11/12] Sanity check RDMA remote data |
Date: |
Thu, 11 Jun 2015 18:17:27 +0100 |
From: "Dr. David Alan Gilbert" <address@hidden>
Perform some basic (but probably not complete) sanity checking on
requests from the RDMA source.
Signed-off-by: Dr. David Alan Gilbert <address@hidden>
Reviewed-by: Michael R. Hines <address@hidden>
---
migration/rdma.c | 30 ++++++++++++++++++++++++++++++
1 file changed, 30 insertions(+)
diff --git a/migration/rdma.c b/migration/rdma.c
index 92dc5c1..1f3a9fb 100644
--- a/migration/rdma.c
+++ b/migration/rdma.c
@@ -2984,6 +2984,13 @@ static int qemu_rdma_registration_handle(QEMUFile *f,
void *opaque)
trace_qemu_rdma_registration_handle_compress(comp->length,
comp->block_idx,
comp->offset);
+ if (comp->block_idx >= rdma->local_ram_blocks.nb_blocks) {
+ error_report("rdma: 'compress' bad block index %u (vs %d)",
+ (unsigned int)comp->block_idx,
+ rdma->local_ram_blocks.nb_blocks);
+ ret = -EIO;
+ break;
+ }
block = &(rdma->local_ram_blocks.block[comp->block_idx]);
host_addr = block->local_host_addr +
@@ -3072,8 +3079,23 @@ static int qemu_rdma_registration_handle(QEMUFile *f,
void *opaque)
trace_qemu_rdma_registration_handle_register_loop(count,
reg->current_index, reg->key.current_addr,
reg->chunks);
+ if (reg->current_index >= rdma->local_ram_blocks.nb_blocks) {
+ error_report("rdma: 'register' bad block index %u (vs %d)",
+ (unsigned int)reg->current_index,
+ rdma->local_ram_blocks.nb_blocks);
+ ret = -ENOENT;
+ break;
+ }
block = &(rdma->local_ram_blocks.block[reg->current_index]);
if (block->is_ram_block) {
+ if (block->offset > reg->key.current_addr) {
+ error_report("rdma: bad register address for block %s"
+ " offset: %" PRIx64 " current_addr: %" PRIx64,
+ block->block_name, block->offset,
+ reg->key.current_addr);
+ ret = -ERANGE;
+ break;
+ }
host_addr = (block->local_host_addr +
(reg->key.current_addr - block->offset));
chunk = ram_chunk_index(block->local_host_addr,
@@ -3082,6 +3104,14 @@ static int qemu_rdma_registration_handle(QEMUFile *f,
void *opaque)
chunk = reg->key.chunk;
host_addr = block->local_host_addr +
(reg->key.chunk * (1UL << RDMA_REG_CHUNK_SHIFT));
+ /* Check for particularly bad chunk value */
+ if (host_addr < (void *)block->local_host_addr) {
+ error_report("rdma: bad chunk for block %s"
+ " chunk: %" PRIx64,
+ block->block_name, reg->key.chunk);
+ ret = -ERANGE;
+ break;
+ }
}
chunk_start = ram_chunk_start(block, chunk);
chunk_end = ram_chunk_end(block, chunk + reg->chunks);
--
2.4.2
- Re: [Qemu-devel] [PATCH v2 06/12] Translate offsets to destination address space, (continued)
- [Qemu-devel] [PATCH v2 07/12] Rework ram_control_load_hook to hook during block load, Dr. David Alan Gilbert (git), 2015/06/11
- [Qemu-devel] [PATCH v2 09/12] Rework ram block hash, Dr. David Alan Gilbert (git), 2015/06/11
- [Qemu-devel] [PATCH v2 08/12] Allow rdma_delete_block to work without the hash, Dr. David Alan Gilbert (git), 2015/06/11
- [Qemu-devel] [PATCH v2 11/12] Sanity check RDMA remote data,
Dr. David Alan Gilbert (git) <=
- [Qemu-devel] [PATCH v2 10/12] Sort destination RAMBlocks to be the same as the source, Dr. David Alan Gilbert (git), 2015/06/11
- [Qemu-devel] [PATCH v2 12/12] Fail more cleanly in mismatched RAM cases, Dr. David Alan Gilbert (git), 2015/06/11