Re: [PATCH] hw/rdma: Fix possible mremap overflow in the pvrdma device (CVE-2021-3582)

From: P J P <pjp@fedoraproject.org>
To: "qemu-devel@nongnu.org" <qemu-devel@nongnu.org>,
	 Marcel Apfelbaum <marcel.apfelbaum@gmail.com>
Cc: "vv474172261@gmail.com" <vv474172261@gmail.com>,
	"mcascell@redhat.com" <mcascell@redhat.com>,
	"yuval.shaia.ml@gmail.com" <yuval.shaia.ml@gmail.com>,
	"mst@redhat.com" <mst@redhat.com>
Subject: Re: [PATCH] hw/rdma: Fix possible mremap overflow in the pvrdma device (CVE-2021-3582)
Date: Thu, 17 Jun 2021 09:38:22 +0000 (UTC)	[thread overview]
Message-ID: <1417967078.884998.1623922702917@mail.yahoo.com> (raw)
In-Reply-To: <20210616110600.20889-1-marcel.apfelbaum@gmail.com>

On Wednesday, 16 June, 2021, 04:36:09 pm IST, Marcel Apfelbaum <marcel.apfelbaum@gmail.com> wrote:
>From: Marcel Apfelbaum <marcel@redhat.com>
>diff --git a/hw/rdma/vmw/pvrdma_cmd.c b/hw/rdma/vmw/pvrdma_cmd.c
>index f59879e257..dadab4966b 100644
>--- a/hw/rdma/vmw/pvrdma_cmd.c
>+++ b/hw/rdma/vmw/pvrdma_cmd.c
>@@ -38,6 +38,12 @@ static void *pvrdma_map_to_pdir(PCIDevice *pdev, uint64_t pdir_dma,
>        return NULL;
>    }
>
>+    length = ROUND_UP(length, TARGET_PAGE_SIZE);
>+    if (nchunks * TARGET_PAGE_SIZE != length) {
>+        rdma_error_report("Invalid nchunks/length (%u, %lu)", nchunks, length);
>+        return NULL;
>+    }
>+
>    dir = rdma_pci_dma_map(pdev, pdir_dma, TARGET_PAGE_SIZE);
>    if (!dir) {
>        rdma_error_report("Failed to map to page directory");
>

Looks okay.
Reviewed-by: Prasad J Pandit <pjp@fedoraproject.org>

Thank you.
---
  -P J P
http://feedmug.com