Commit 962cc99d83 for qemu.org

commit 962cc99d83a3a74274f070a5032f08b9d539ca50
Author: Peter Xu <peterx@redhat.com>
Date:   Thu Aug 20 16:03:21 2026 -0400

    migration/rdma: Sanity check upper bound of register MR address

    Before registration of RDMA ranges, QEMU destination checks for validity of
    current_addr no less than the target ramblock's start address.  But it
    didn't check for the upper bound to make sure the address is within the
    size of the ramblock.  Add it.

    Reported-by: Tristan (@TristanInSec)
    Closes: https://gitlab.com/qemu-project/qemu/-/work_items/4007
    Reviewed-by: Jinpu Wang <jinpu.wang@cloud.ionos.com>
    Signed-off-by: Peter Xu <peterx@redhat.com>
    Reviewed-by: Fabiano Rosas <farosas@suse.de>
    Reviewed-by: Jack Wang <jinpu.wang@cloud.ionos.com>
    Signed-off-by: Fabiano Rosas <farosas@suse.de>

diff --git a/migration/rdma.c b/migration/rdma.c
index cf6688a4bc..d8953363fe 100644
--- a/migration/rdma.c
+++ b/migration/rdma.c
@@ -3387,7 +3387,8 @@ int rdma_registration_handle(QEMUFile *f)
                     goto err;
                 }
                 block = &(rdma->local_ram_blocks.block[reg->current_index]);
-                if (block->offset > reg->current_addr) {
+                if (block->offset > reg->current_addr ||
+                    block->offset + block->length <= reg->current_addr) {
                     error_report("rdma: bad register address for block %s"
                         " offset: %" PRIx64 " current_addr: %" PRIx64,
                         block->block_name, block->offset,