OpenE2K/qemu-e2k
13
4
Fork 0
Code Issues 4 Pull Requests Projects 2 Releases Activity

hw/block/nvme: fix log page offset check

Browse Source 
Return error if the requested offset starts after the size of the log
being returned. Also, move the check for earlier in the function so
we're not doing unnecessary calculations.

Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed- by: Dmitry Fomichev <dmitry.fomichev@wdc.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
This commit is contained in:
Keith Busch 2020-09-30 10:01:02 -07:00 committed by Klaus Jensen
parent 8c125590df
commit a740facfbd
1 changed files with 10 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
hw/block/nvme.c
View File

@ -1179,6 +1179,10 @@ static uint16_t nvme_smart_info(NvmeCtrl *n, uint8_t rae, uint32_t buf_len,
return NVME_INVALID_FIELD | NVME_DNR; return NVME_INVALID_FIELD | NVME_DNR;
} }
if (off >= sizeof(smart)) {
return NVME_INVALID_FIELD | NVME_DNR;
}
for (int i = 1; i <= n->num_namespaces; i++) { for (int i = 1; i <= n->num_namespaces; i++) {
NvmeNamespace *ns = nvme_ns(n, i); NvmeNamespace *ns = nvme_ns(n, i);
if (!ns) { if (!ns) {
@ -1193,10 +1197,6 @@ static uint16_t nvme_smart_info(NvmeCtrl *n, uint8_t rae, uint32_t buf_len,
write_commands += s->nr_ops[BLOCK_ACCT_WRITE]; write_commands += s->nr_ops[BLOCK_ACCT_WRITE];
} }
if (off > sizeof(smart)) {
return NVME_INVALID_FIELD | NVME_DNR;
}
trans_len = MIN(sizeof(smart) - off, buf_len); trans_len = MIN(sizeof(smart) - off, buf_len);
memset(&smart, 0x0, sizeof(smart)); memset(&smart, 0x0, sizeof(smart));
@ -1234,12 +1234,11 @@ static uint16_t nvme_fw_log_info(NvmeCtrl *n, uint32_t buf_len, uint64_t off,
.afi = 0x1, .afi = 0x1,
}; };
strpadcpy((char *)&fw_log.frs1, sizeof(fw_log.frs1), "1.0", ' '); if (off >= sizeof(fw_log)) {
if (off > sizeof(fw_log)) {
return NVME_INVALID_FIELD | NVME_DNR; return NVME_INVALID_FIELD | NVME_DNR;
} }
strpadcpy((char *)&fw_log.frs1, sizeof(fw_log.frs1), "1.0", ' ');
trans_len = MIN(sizeof(fw_log) - off, buf_len); trans_len = MIN(sizeof(fw_log) - off, buf_len);
return nvme_dma(n, (uint8_t *) &fw_log + off, trans_len, return nvme_dma(n, (uint8_t *) &fw_log + off, trans_len,
@ -1252,16 +1251,15 @@ static uint16_t nvme_error_info(NvmeCtrl *n, uint8_t rae, uint32_t buf_len,
uint32_t trans_len; uint32_t trans_len;
NvmeErrorLog errlog; NvmeErrorLog errlog;
if (off >= sizeof(errlog)) {
return NVME_INVALID_FIELD | NVME_DNR;
}
if (!rae) { if (!rae) {
nvme_clear_events(n, NVME_AER_TYPE_ERROR); nvme_clear_events(n, NVME_AER_TYPE_ERROR);
} }
if (off > sizeof(errlog)) {
return NVME_INVALID_FIELD | NVME_DNR;
}
memset(&errlog, 0x0, sizeof(errlog)); memset(&errlog, 0x0, sizeof(errlog));
trans_len = MIN(sizeof(errlog) - off, buf_len); trans_len = MIN(sizeof(errlog) - off, buf_len);
return nvme_dma(n, (uint8_t *)&errlog, trans_len, return nvme_dma(n, (uint8_t *)&errlog, trans_len,