From 3ae8a54a087d54cfd109ab3d844ff4cba54a28d8 Mon Sep 17 00:00:00 2001 From: Klaus Jensen Date: Wed, 24 May 2023 11:28:34 +0200 Subject: [PATCH] hw/nvme: fix verification of number of ruhis Fix a off-by-one error when verifying the number of reclaim unit handle identifiers specified in fdp.ruhs. To make the fix nicer, move the verification of the fdp.nruh parameter to an earlier point. Fixes: 73064edfb864 ("hw/nvme: flexible data placement emulation") Reviewed-by: Jesper Wendel Devantier Signed-off-by: Klaus Jensen --- hw/nvme/ns.c | 4 +--- hw/nvme/subsys.c | 6 ++++-- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/hw/nvme/ns.c b/hw/nvme/ns.c index 547c0b1543..050fdaf50f 100644 --- a/hw/nvme/ns.c +++ b/hw/nvme/ns.c @@ -438,9 +438,7 @@ static bool nvme_ns_init_fdp(NvmeNamespace *ns, Error **errp) /* parse the placement handle identifiers */ while ((token = qemu_strsep(&p, ";")) != NULL) { - ns->fdp.nphs += 1; - if (ns->fdp.nphs > NVME_FDP_MAXPIDS || - ns->fdp.nphs == endgrp->fdp.nruh) { + if (ns->fdp.nphs++ == endgrp->fdp.nruh) { error_setg(errp, "too many placement handles"); free(r); return false; diff --git a/hw/nvme/subsys.c b/hw/nvme/subsys.c index 24ddec860e..d30bb8bfd5 100644 --- a/hw/nvme/subsys.c +++ b/hw/nvme/subsys.c @@ -158,8 +158,10 @@ static bool nvme_subsys_setup_fdp(NvmeSubsystem *subsys, Error **errp) endgrp->fdp.nrg = subsys->params.fdp.nrg; - if (!subsys->params.fdp.nruh) { - error_setg(errp, "fdp.nruh must be non-zero"); + if (!subsys->params.fdp.nruh || + subsys->params.fdp.nruh > NVME_FDP_MAXPIDS) { + error_setg(errp, "fdp.nruh must be non-zero and less than %u", + NVME_FDP_MAXPIDS); return false; }