projects / qemu.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: cce6486) | patch
rdma: check num_sge does not exceed MAX_SGE
authorPrasad J Pandit <pjp@fedoraproject.org>
Wed, 12 Dec 2018 19:30:34 +0000 (01:00 +0530)
committerMarcel Apfelbaum <marcel.apfelbaum@gmail.com>
Sat, 22 Dec 2018 09:09:57 +0000 (11:09 +0200)
commit0e68373cc2b3a063ce067bc0cc3edaf370752890
treeaaf689ada6d7b8f1cc0dcde50100213a86470762tree | snapshot
parentcce648613bc802be1b894227f7fd94d88476ea07commit | diff
rdma: check num_sge does not exceed MAX_SGE

rdma back-end has scatter/gather array ibv_sge[MAX_SGE=4] set
to have 4 elements. A guest could send a 'PvrdmaSqWqe' ring element
with 'num_sge' set to > MAX_SGE, which may lead to OOB access issue.
Add check to avoid it.

Reported-by: Saar Amar <saaramar5@gmail.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Reviewed-by: Yuval Shaia <yuval.shaia@oracle.com>
Signed-off-by: Marcel Apfelbaum <marcel.apfelbaum@gmail.com>
hw/rdma/rdma_backend.c diff | blob | history
Unnamed repository; edit this file 'description' to name the repository.