From cecb1f8cba3d5e15f6f16e7156dfc4e5bbfd36c0 Mon Sep 17 00:00:00 2001

From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>

Date: Thu, 27 Jul 2017 12:06:58 +0200

Subject: [PATCH 10/17] migration/rdma: Safely convert control types

RH-Author: Dr. David Alan Gilbert <dgilbert@redhat.com>

Message-id: <20170727120659.8640-5-dgilbert@redhat.com>

Patchwork-id: 75860

O-Subject: [Pegas-1.0 qemu-kvm PATCH 4/5] migration/rdma: Safely convert control types

Bugzilla: 1475751

RH-Acked-by: Peter Xu <peterx@redhat.com>

RH-Acked-by: Laurent Vivier <lvivier@redhat.com>

RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>

From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>

control_desc[] is an array of strings that correspond to a

series of message types; they're used only for error messages, but if

the message type is seriously broken then we could go off the end of

the array.

Convert the array to a function control_desc() that bound checks.

Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>

Reviewed-by: Peter Xu <peterx@redhat.com>

Reviewed-by: Juan Quintela <quintela@redhat.com>

Message-Id: <20170717110936.23314-6-dgilbert@redhat.com>

Signed-off-by: Juan Quintela <quintela@redhat.com>

(cherry picked from commit 482a33c53cbc9d2b0c47d4df03b659bf50258c21)

Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>

---

 migration/rdma.c | 54 ++++++++++++++++++++++++++++++++----------------------

 1 file changed, 32 insertions(+), 22 deletions(-)

diff --git a/migration/rdma.c b/migration/rdma.c

index 666c84f..fa88ccf 100644

--- a/migration/rdma.c

+++ b/migration/rdma.c

@@ -163,20 +163,6 @@ enum {

     RDMA_CONTROL_UNREGISTER_FINISHED, /* unpinning finished */

 };

-static const char *control_desc[] = {

-    [RDMA_CONTROL_NONE] = "NONE",

-    [RDMA_CONTROL_ERROR] = "ERROR",

-    [RDMA_CONTROL_READY] = "READY",

-    [RDMA_CONTROL_QEMU_FILE] = "QEMU FILE",

-    [RDMA_CONTROL_RAM_BLOCKS_REQUEST] = "RAM BLOCKS REQUEST",

-    [RDMA_CONTROL_RAM_BLOCKS_RESULT] = "RAM BLOCKS RESULT",

-    [RDMA_CONTROL_COMPRESS] = "COMPRESS",

-    [RDMA_CONTROL_REGISTER_REQUEST] = "REGISTER REQUEST",

-    [RDMA_CONTROL_REGISTER_RESULT] = "REGISTER RESULT",

-    [RDMA_CONTROL_REGISTER_FINISHED] = "REGISTER FINISHED",

-    [RDMA_CONTROL_UNREGISTER_REQUEST] = "UNREGISTER REQUEST",

-    [RDMA_CONTROL_UNREGISTER_FINISHED] = "UNREGISTER FINISHED",

-};

 /*

  * Memory and MR structures used to represent an IB Send/Recv work request.

@@ -249,6 +235,30 @@ typedef struct QEMU_PACKED RDMADestBlock {

     uint32_t padding;

 } RDMADestBlock;

+static const char *control_desc(unsigned int rdma_control)

+{

+    static const char *strs[] = {

+        [RDMA_CONTROL_NONE] = "NONE",

+        [RDMA_CONTROL_ERROR] = "ERROR",

+        [RDMA_CONTROL_READY] = "READY",

+        [RDMA_CONTROL_QEMU_FILE] = "QEMU FILE",

+        [RDMA_CONTROL_RAM_BLOCKS_REQUEST] = "RAM BLOCKS REQUEST",

+        [RDMA_CONTROL_RAM_BLOCKS_RESULT] = "RAM BLOCKS RESULT",

+        [RDMA_CONTROL_COMPRESS] = "COMPRESS",

+        [RDMA_CONTROL_REGISTER_REQUEST] = "REGISTER REQUEST",

+        [RDMA_CONTROL_REGISTER_RESULT] = "REGISTER RESULT",

+        [RDMA_CONTROL_REGISTER_FINISHED] = "REGISTER FINISHED",

+        [RDMA_CONTROL_UNREGISTER_REQUEST] = "UNREGISTER REQUEST",

+        [RDMA_CONTROL_UNREGISTER_FINISHED] = "UNREGISTER FINISHED",

+    };

+

+    if (rdma_control > RDMA_CONTROL_UNREGISTER_FINISHED) {

+        return "??BAD CONTROL VALUE??";

+    }

+

+    return strs[rdma_control];

+}

+

 static uint64_t htonll(uint64_t v)

 {

     union { uint32_t lv[2]; uint64_t llv; } u;

@@ -1639,7 +1649,7 @@ static int qemu_rdma_post_send_control(RDMAContext *rdma, uint8_t *buf,

                                    .num_sge = 1,

                                 };

-    trace_qemu_rdma_post_send_control(control_desc[head->type]);

+    trace_qemu_rdma_post_send_control(control_desc(head->type));

     /*

      * We don't actually need to do a memcpy() in here if we used

@@ -1718,16 +1728,16 @@ static int qemu_rdma_exchange_get_response(RDMAContext *rdma,

     network_to_control((void *) rdma->wr_data[idx].control);

     memcpy(head, rdma->wr_data[idx].control, sizeof(RDMAControlHeader));

-    trace_qemu_rdma_exchange_get_response_start(control_desc[expecting]);

+    trace_qemu_rdma_exchange_get_response_start(control_desc(expecting));

     if (expecting == RDMA_CONTROL_NONE) {

-        trace_qemu_rdma_exchange_get_response_none(control_desc[head->type],

+        trace_qemu_rdma_exchange_get_response_none(control_desc(head->type),

                                              head->type);

     } else if (head->type != expecting || head->type == RDMA_CONTROL_ERROR) {

         error_report("Was expecting a %s (%d) control message"

                 ", but got: %s (%d), length: %d",

-                control_desc[expecting], expecting,

-                control_desc[head->type], head->type, head->len);

+                control_desc(expecting), expecting,

+                control_desc(head->type), head->type, head->len);

         if (head->type == RDMA_CONTROL_ERROR) {

             rdma->received_error = true;

         }

@@ -1837,7 +1847,7 @@ static int qemu_rdma_exchange_send(RDMAContext *rdma, RDMAControlHeader *head,

             }

         }

-        trace_qemu_rdma_exchange_send_waiting(control_desc[resp->type]);

+        trace_qemu_rdma_exchange_send_waiting(control_desc(resp->type));

         ret = qemu_rdma_exchange_get_response(rdma, resp,

                                               resp->type, RDMA_WRID_DATA);

@@ -1849,7 +1859,7 @@ static int qemu_rdma_exchange_send(RDMAContext *rdma, RDMAControlHeader *head,

         if (resp_idx) {

             *resp_idx = RDMA_WRID_DATA;

         }

-        trace_qemu_rdma_exchange_send_received(control_desc[resp->type]);

+        trace_qemu_rdma_exchange_send_received(control_desc(resp->type));

     }

     rdma->control_ready_expected = 1;

@@ -3399,7 +3409,7 @@ static int qemu_rdma_registration_handle(QEMUFile *f, void *opaque)

             ret = -EIO;

             goto out;

         default:

-            error_report("Unknown control message %s", control_desc[head.type]);

+            error_report("Unknown control message %s", control_desc(head.type));

             ret = -EIO;

             goto out;

         }

-- 

1.8.3.1