> RDMAControlHeader::len is remote-provided. So validate the value before use. > > Isaku Yamahata (3): > rdma: use resp.len after validation in qemu_rdma_registration_stop > rdma: validate RDMAControlHeader::len > rdma: check if RDMAControlHeader::len match transferred byte > > migration-rdma.c | 44 ++++++++++++++++++++++++++++++-------------- > 1 file changed, 30 insertions(+), 14 deletions(-)
Looks good, thanks! We will have a mix of assertions and errors after this patch. Asserting on the destination is probably okay, but as a follow-up perhaps we can change the assertion(s) to errors. Paolo
