[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL for-6.0 v2 09/10] hw/block/nvme: fix assert crash in nvme_subsys_n
From: |
Klaus Jensen |
Subject: |
[PULL for-6.0 v2 09/10] hw/block/nvme: fix assert crash in nvme_subsys_ns |
Date: |
Wed, 7 Apr 2021 07:46:34 +0200 |
From: Klaus Jensen <k.jensen@samsung.com>
nvme_subsys_ns() is used in contexts where the namespace identifier is
taken from an untrusted source. Commit 3921756dee6d ("hw/block/nvme:
assert namespaces array indices") tried to guard against this by
introducing an assert on the namespace identifier.
This is wrong since it is perfectly valid to call the function with an
invalid namespace identifier and like nvme_ns(), nvme_subsys_ns() should
simply return NULL.
Fixes: 3921756dee6d ("hw/block/nvme: assert namespaces array indices")
Fixes: 94d8d6d16781 ("hw/block/nvme: support allocated namespace type")
Cc: Minwoo Im <minwoo.im.dev@gmail.com>
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
Reviewed-by: Minwoo Im <minwoo.im.dev@gmail.com>
---
hw/block/nvme-subsys.h | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/hw/block/nvme-subsys.h b/hw/block/nvme-subsys.h
index 24132edd005c..1cbcad9be23e 100644
--- a/hw/block/nvme-subsys.h
+++ b/hw/block/nvme-subsys.h
@@ -49,12 +49,10 @@ static inline NvmeCtrl *nvme_subsys_ctrl(NvmeSubsystem
*subsys,
static inline NvmeNamespace *nvme_subsys_ns(NvmeSubsystem *subsys,
uint32_t nsid)
{
- if (!subsys) {
+ if (!subsys || !nsid || nsid > NVME_MAX_NAMESPACES) {
return NULL;
}
- assert(nsid && nsid <= NVME_MAX_NAMESPACES);
-
return subsys->namespaces[nsid];
}
--
2.31.1
- [PULL for-6.0 v2 00/10] emulated nvme fixes for -rc3, Klaus Jensen, 2021/04/07
- [PULL for-6.0 v2 01/10] hw/block/nvme: fix pi constraint check, Klaus Jensen, 2021/04/07
- [PULL for-6.0 v2 02/10] hw/block/nvme: fix missing string representation for ns attachment, Klaus Jensen, 2021/04/07
- [PULL for-6.0 v2 04/10] hw/block/nvme: fix warning about legacy namespace configuration, Klaus Jensen, 2021/04/07
- [PULL for-6.0 v2 05/10] hw/block/nvme: update dmsrl limit on namespace detachment, Klaus Jensen, 2021/04/07
- [PULL for-6.0 v2 03/10] hw/block/nvme: fix the nsid 'invalid' value, Klaus Jensen, 2021/04/07
- [PULL for-6.0 v2 06/10] hw/block/nvme: fix handling of private namespaces, Klaus Jensen, 2021/04/07
- [PULL for-6.0 v2 07/10] hw/block/nvme: add missing copyright headers, Klaus Jensen, 2021/04/07
- [PULL for-6.0 v2 08/10] hw/block/nvme: fix ns attachment out-of-bounds read, Klaus Jensen, 2021/04/07
- [PULL for-6.0 v2 10/10] hw/block/nvme: fix out-of-bounds read in nvme_subsys_ctrl, Klaus Jensen, 2021/04/07
- [PULL for-6.0 v2 09/10] hw/block/nvme: fix assert crash in nvme_subsys_ns,
Klaus Jensen <=
- Re: [PULL for-6.0 v2 00/10] emulated nvme fixes for -rc3, Peter Maydell, 2021/04/07