From a2aad899158f118fd8ab16531385b9fc2b48ba14 Mon Sep 17 00:00:00 2001 Message-Id: In-Reply-To: References: From: Nigel Croxon Date: Thu, 14 Nov 2013 22:53:03 +0100 Subject: [PATCH 27/46] rdma: use resp.len after validation in qemu_rdma_registration_stop RH-Author: Nigel Croxon Message-id: <1384469598-13137-28-git-send-email-ncroxon@redhat.com> Patchwork-id: 55716 O-Subject: [RHEL7.0 PATCH 27/42] rdma: use resp.len after validation in qemu_rdma_registration_stop Bugzilla: 1011720 RH-Acked-by: Orit Wasserman RH-Acked-by: Amit Shah RH-Acked-by: Paolo Bonzini Bugzilla: 1011720 https://bugzilla.redhat.com/show_bug.cgi?id=1011720 >From commit ID: commit 885e8f984ea846e79a39ddc4f066f4dd3d04b264 Author: Isaku Yamahata Date: Fri Aug 9 16:05:40 2013 -0400 rdma: use resp.len after validation in qemu_rdma_registration_stop resp.len is given from remote host. So should be validated before use. Otherwise memcpy can access beyond the buffer. Cc: Michael R. Hines Reviewed-by: Orit Wasserman Reviewed-by: Michael R. Hines Signed-off-by: Isaku Yamahata Signed-off-by: Michael R. Hines Message-id: 1376078746-24948-2-git-send-email-mrhines@linux.vnet.ibm.com Signed-off-by: Anthony Liguori --- migration-rdma.c | 7 +++---- 1 files changed, 3 insertions(+), 4 deletions(-) Signed-off-by: Michal Novotny --- migration-rdma.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/migration-rdma.c b/migration-rdma.c index ff0a823..1412cde 100644 --- a/migration-rdma.c +++ b/migration-rdma.c @@ -3045,10 +3045,6 @@ static int qemu_rdma_registration_stop(QEMUFile *f, void *opaque, return ret; } - qemu_rdma_move_header(rdma, reg_result_idx, &resp); - memcpy(rdma->block, - rdma->wr_data[reg_result_idx].control_curr, resp.len); - nb_remote_blocks = resp.len / sizeof(RDMARemoteBlock); /* @@ -3070,6 +3066,9 @@ static int qemu_rdma_registration_stop(QEMUFile *f, void *opaque, return -EINVAL; } + qemu_rdma_move_header(rdma, reg_result_idx, &resp); + memcpy(rdma->block, + rdma->wr_data[reg_result_idx].control_curr, resp.len); for (i = 0; i < nb_remote_blocks; i++) { network_to_remote_block(&rdma->block[i]); -- 1.7.11.7