From ec20329748d02728b823443436fe26eadb04f8cc Mon Sep 17 00:00:00 2001 From: Klaus Jensen Date: Wed, 7 Apr 2021 07:07:43 +0200 Subject: [PATCH] hw/block/nvme: fix assert crash in nvme_subsys_ns nvme_subsys_ns() is used in contexts where the namespace identifier is taken from an untrusted source. Commit 3921756dee6d ("hw/block/nvme: assert namespaces array indices") tried to guard against this by introducing an assert on the namespace identifier. This is wrong since it is perfectly valid to call the function with an invalid namespace identifier and like nvme_ns(), nvme_subsys_ns() should simply return NULL. Fixes: 3921756dee6d ("hw/block/nvme: assert namespaces array indices") Fixes: 94d8d6d16781 ("hw/block/nvme: support allocated namespace type") Cc: Minwoo Im Signed-off-by: Klaus Jensen Reviewed-by: Minwoo Im --- hw/block/nvme-subsys.h | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/hw/block/nvme-subsys.h b/hw/block/nvme-subsys.h index 24132edd00..1cbcad9be2 100644 --- a/hw/block/nvme-subsys.h +++ b/hw/block/nvme-subsys.h @@ -49,12 +49,10 @@ static inline NvmeCtrl *nvme_subsys_ctrl(NvmeSubsystem *subsys, static inline NvmeNamespace *nvme_subsys_ns(NvmeSubsystem *subsys, uint32_t nsid) { - if (!subsys) { + if (!subsys || !nsid || nsid > NVME_MAX_NAMESPACES) { return NULL; } - assert(nsid && nsid <= NVME_MAX_NAMESPACES); - return subsys->namespaces[nsid]; }