[PATCH] block/nvme: Fix possible array index out of bounds in nvme_process_completion()

* [PATCH] block/nvme: Fix possible array index out of bounds in nvme_process_completion()
@ 2020-12-08 14:44 Alex Chen
  0 siblings, 0 replies; only message in thread
From: Alex Chen @ 2020-12-08 14:44 UTC (permalink / raw)
  To: fam, kwolf, mreitz
  Cc: alex.chen, qemu-trivial, qemu-devel, qemu-block, zhang.zhanghailiang

The range of 'cid' is [1, NVME_QUEUE_SIZE-1], so when 'cid' is equal to
NVME_QUEUE_SIZE, it should be continued, otherwise it will lead to array
index out of bounds when accessing 'q->reqs[cid-1]'

Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: Alex Chen <alex.chen@huawei.com>
---
 block/nvme.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/block/nvme.c b/block/nvme.c
index a06a188d53..3a2b3f5486 100644
--- a/block/nvme.c
+++ b/block/nvme.c
@@ -402,7 +402,7 @@ static bool nvme_process_completion(NVMeQueuePair *q)
             q->cq_phase = !q->cq_phase;
         }
         cid = le16_to_cpu(c->cid);
-        if (cid == 0 || cid > NVME_QUEUE_SIZE) {
+        if (cid == 0 || cid >= NVME_QUEUE_SIZE) {
             warn_report("NVMe: Unexpected CID in completion queue: %"PRIu32", "
                         "queue size: %u", cid, NVME_QUEUE_SIZE);
             continue;
-- 
2.19.1



^ permalink raw reply related	[flat|nested] only message in thread