Subject: [PATCH 28/46] rdma: validate RDMAControlHeader::len

From: Nigel Croxon <[email-masked]>
Date: Thu, 14 Nov 2013 22:53:04 +0100

RH-Author: Nigel Croxon <[email-masked]>
Message-id: <[email-masked]>
Patchwork-id: 55709
O-Subject: [RHEL7.0 PATCH 28/42] rdma: validate RDMAControlHeader::len
Bugzilla: 1011720
RH-Acked-by: Orit Wasserman <[email-masked]>
RH-Acked-by: Amit Shah <[email-masked]>
RH-Acked-by: Paolo Bonzini <[email-masked]>

Bugzilla: 1011720
https://bugzilla.redhat.com/show_bug.cgi?id=1011720

>From commit ID:
commit 6f1484edadba57f2800dc04ae3527ee4b6dac7ef
Author: Isaku Yamahata <[email-masked]>
Date:   Fri Aug 9 16:05:41 2013 -0400

    rdma: validate RDMAControlHeader::len

    RMDAControlHeader::len is provided from remote, so validate it.

    Reviewed-by: Orit Wasserman <[email-masked]>
    Reviewed-by: Michael R. Hines <[email-masked]>
    Signed-off-by: Isaku Yamahata <[email-masked]>
    Signed-off-by: Michael R. Hines <[email-masked]>
    Message-id: [email-masked]
    Signed-off-by: Anthony Liguori <[email-masked]>
---
 migration-rdma.c |    5 +++++
 1 files changed, 5 insertions(+), 0 deletions(-)

Signed-off-by: Michal Novotny <[email-masked]>
---
 migration-rdma.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/migration-rdma.c b/migration-rdma.c
index 1412cde..140d930 100644
--- a/migration-rdma.c
+++ b/migration-rdma.c
@@ -1424,6 +1424,7 @@ static int qemu_rdma_post_send_control(RDMAContext *rdma, uint8_t *buf,
      * The copy makes the RDMAControlHeader simpler to manipulate
      * for the time being.
      */
+    assert(head->len <= RDMA_CONTROL_MAX_BUFFER - sizeof(*head));
     memcpy(wr->control, head, sizeof(RDMAControlHeader));
     control_to_network((void *) wr->control);
 
@@ -1504,6 +1505,10 @@ static int qemu_rdma_exchange_get_response(RDMAContext *rdma,
                 control_desc[head->type], head->type, head->len);
         return -EIO;
     }
+    if (head->len > RDMA_CONTROL_MAX_BUFFER - sizeof(*head)) {
+        fprintf(stderr, "too long length: %d\n", head->len);
+        return -EINVAL;
+    }
 
     return 0;
 }
-- 
1.7.11.7