Subject: [PATCH 27/46] rdma: use resp.len after validation in qemu_rdma_registration_stop

From: Nigel Croxon <[email-masked]>
Date: Thu, 14 Nov 2013 22:53:03 +0100

RH-Author: Nigel Croxon <[email-masked]>
Message-id: <[email-masked]>
Patchwork-id: 55716
O-Subject: [RHEL7.0 PATCH 27/42] rdma: use resp.len after validation in qemu_rdma_registration_stop
Bugzilla: 1011720
RH-Acked-by: Orit Wasserman <[email-masked]>
RH-Acked-by: Amit Shah <[email-masked]>
RH-Acked-by: Paolo Bonzini <[email-masked]>

Bugzilla: 1011720
https://bugzilla.redhat.com/show_bug.cgi?id=1011720

>From commit ID:
commit 885e8f984ea846e79a39ddc4f066f4dd3d04b264
Author: Isaku Yamahata <[email-masked]>
Date:   Fri Aug 9 16:05:40 2013 -0400

    rdma: use resp.len after validation in qemu_rdma_registration_stop

    resp.len is given from remote host. So should be validated before use.
    Otherwise memcpy can access beyond the buffer.

    Cc: Michael R. Hines <[email-masked]>
    Reviewed-by: Orit Wasserman <[email-masked]>
    Reviewed-by: Michael R. Hines <[email-masked]>
    Signed-off-by: Isaku Yamahata <[email-masked]>
    Signed-off-by: Michael R. Hines <[email-masked]>
    Message-id: [email-masked]
    Signed-off-by: Anthony Liguori <[email-masked]>
---
 migration-rdma.c |    7 +++----
 1 files changed, 3 insertions(+), 4 deletions(-)

Signed-off-by: Michal Novotny <[email-masked]>
---
 migration-rdma.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/migration-rdma.c b/migration-rdma.c
index ff0a823..1412cde 100644
--- a/migration-rdma.c
+++ b/migration-rdma.c
@@ -3045,10 +3045,6 @@ static int qemu_rdma_registration_stop(QEMUFile *f, void *opaque,
             return ret;
         }
 
-        qemu_rdma_move_header(rdma, reg_result_idx, &resp);
-        memcpy(rdma->block,
-            rdma->wr_data[reg_result_idx].control_curr, resp.len);
-
         nb_remote_blocks = resp.len / sizeof(RDMARemoteBlock);
 
         /*
@@ -3070,6 +3066,9 @@ static int qemu_rdma_registration_stop(QEMUFile *f, void *opaque,
             return -EINVAL;
         }
 
+        qemu_rdma_move_header(rdma, reg_result_idx, &resp);
+        memcpy(rdma->block,
+            rdma->wr_data[reg_result_idx].control_curr, resp.len);
         for (i = 0; i < nb_remote_blocks; i++) {
             network_to_remote_block(&rdma->block[i]);
 
-- 
1.7.11.7