Commit 636d0cd59b for qemu.org

commit 636d0cd59bd575329ed3524d014bde5cc287ddea
Author: Peter Xu <peterx@redhat.com>
Date:   Thu Aug 20 16:03:22 2026 -0400

    migration/rdma: Sanity check compress request ranges

    The offset/length ranges are not sanity checked in RDMA requests, add the
    checks.

    Reported-by: Tristan (@TristanInSec)
    Closes: https://gitlab.com/qemu-project/qemu/-/work_items/4005
    Reviewed-by: Jinpu Wang <jinpu.wang@cloud.ionos.com>
    Signed-off-by: Peter Xu <peterx@redhat.com>
    Reviewed-by: Fabiano Rosas <farosas@suse.de>
    Reviewed-by: Jack Wang <jinpu.wang@cloud.ionos.com>
    Signed-off-by: Fabiano Rosas <farosas@suse.de>

diff --git a/migration/rdma.c b/migration/rdma.c
index d8953363fe..e976739fad 100644
--- a/migration/rdma.c
+++ b/migration/rdma.c
@@ -3198,6 +3198,28 @@ static int dest_ram_sort_func(const void *a, const void *b)
     return (a_index < b_index) ? -1 : (a_index != b_index);
 }

+static bool rdma_compress_range_check(RDMALocalBlock *block,
+                                      RDMACompress *comp)
+{
+    uint64_t block_end = block->offset + block->length;
+    uint64_t comp_end;
+
+    if (uadd64_overflow(comp->offset, comp->length, &comp_end)) {
+        goto fail;
+    }
+
+    if (comp->offset < block->offset || comp_end > block_end) {
+        goto fail;
+    }
+
+    return true;
+fail:
+    error_report("%s: compress request range outside range"
+                 " (block=%s, offset=%"PRIu64", length=%"PRIu64")",
+                 __func__, block->block_name, comp->offset, comp->length);
+    return false;
+}
+
 /*
  * During each iteration of the migration, we listen for instructions
  * by the source VM to perform dynamic page registrations before they
@@ -3277,7 +3299,9 @@ int rdma_registration_handle(QEMUFile *f)
                 goto err;
             }
             block = &(rdma->local_ram_blocks.block[comp->block_idx]);
-
+            if (!rdma_compress_range_check(block, comp)) {
+                goto err;
+            }
             host_addr = block->local_host_addr +
                             (comp->offset - block->offset);
             if (comp->value) {