From: Klaus Jensen <its@irrelevant.dk>
To: qemu-devel@nongnu.org
Cc: Fam Zheng <fam@euphon.net>, Kevin Wolf <kwolf@redhat.com>,
qemu-block@nongnu.org, Klaus Jensen <k.jensen@samsung.com>,
Maxim Levitsky <mlevitsk@redhat.com>,
Klaus Jensen <its@irrelevant.dk>,
Andrzej Jakowski <andrzej.jakowski@linux.intel.com>,
Minwoo Im <minwoo.im.dev@gmail.com>,
Keith Busch <kbusch@kernel.org>, Max Reitz <mreitz@redhat.com>
Subject: [PATCH v2 10/16] hw/block/nvme: refactor request bounds checking
Date: Thu, 30 Jul 2020 00:06:32 +0200 [thread overview]
Message-ID: <20200729220638.344477-11-its@irrelevant.dk> (raw)
In-Reply-To: <20200729220638.344477-1-its@irrelevant.dk>
From: Klaus Jensen <k.jensen@samsung.com>
Hoist bounds checking into its own function and check for wrap-around.
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
Reviewed-by: Maxim Levitsky <mlevitsk@redhat.com>
Reviewed-by: Minwoo Im <minwoo.im.dev@gmail.com>
---
hw/block/nvme.c | 26 +++++++++++++++++++++-----
1 file changed, 21 insertions(+), 5 deletions(-)
diff --git a/hw/block/nvme.c b/hw/block/nvme.c
index 45e4060d52d9..c35b35ed41c4 100644
--- a/hw/block/nvme.c
+++ b/hw/block/nvme.c
@@ -555,6 +555,18 @@ static void nvme_clear_events(NvmeCtrl *n, uint8_t event_type)
}
}
+static inline uint16_t nvme_check_bounds(NvmeCtrl *n, NvmeNamespace *ns,
+ uint64_t slba, uint32_t nlb)
+{
+ uint64_t nsze = le64_to_cpu(ns->id_ns.nsze);
+
+ if (unlikely(UINT64_MAX - slba < nlb || slba + nlb > nsze)) {
+ return NVME_LBA_RANGE | NVME_DNR;
+ }
+
+ return NVME_SUCCESS;
+}
+
static void nvme_rw_cb(void *opaque, int ret)
{
NvmeRequest *req = opaque;
@@ -602,12 +614,14 @@ static uint16_t nvme_write_zeros(NvmeCtrl *n, NvmeNamespace *ns, NvmeCmd *cmd,
uint32_t nlb = le16_to_cpu(rw->nlb) + 1;
uint64_t offset = slba << data_shift;
uint32_t count = nlb << data_shift;
+ uint16_t status;
trace_pci_nvme_write_zeroes(nvme_cid(req), slba, nlb);
- if (unlikely(slba + nlb > ns->id_ns.nsze)) {
+ status = nvme_check_bounds(n, ns, slba, nlb);
+ if (status) {
trace_pci_nvme_err_invalid_lba_range(slba, nlb, ns->id_ns.nsze);
- return NVME_LBA_RANGE | NVME_DNR;
+ return status;
}
block_acct_start(blk_get_stats(n->conf.blk), &req->acct, 0,
@@ -630,13 +644,15 @@ static uint16_t nvme_rw(NvmeCtrl *n, NvmeNamespace *ns, NvmeCmd *cmd,
uint64_t data_offset = slba << data_shift;
int is_write = rw->opcode == NVME_CMD_WRITE ? 1 : 0;
enum BlockAcctType acct = is_write ? BLOCK_ACCT_WRITE : BLOCK_ACCT_READ;
+ uint16_t status;
trace_pci_nvme_rw(is_write ? "write" : "read", nlb, data_size, slba);
- if (unlikely((slba + nlb) > ns->id_ns.nsze)) {
- block_acct_invalid(blk_get_stats(n->conf.blk), acct);
+ status = nvme_check_bounds(n, ns, slba, nlb);
+ if (status) {
trace_pci_nvme_err_invalid_lba_range(slba, nlb, ns->id_ns.nsze);
- return NVME_LBA_RANGE | NVME_DNR;
+ block_acct_invalid(blk_get_stats(n->conf.blk), acct);
+ return status;
}
if (nvme_map_dptr(n, cmd, data_size, req)) {
--
2.27.0
next prev parent reply other threads:[~2020-07-29 22:10 UTC|newest]
Thread overview: 33+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-07-29 22:06 [PATCH v2 00/16] hw/block/nvme: dma handling and address mapping cleanup Klaus Jensen
2020-07-29 22:06 ` [PATCH v2 01/16] hw/block/nvme: memset preallocated requests structures Klaus Jensen
2020-07-30 10:14 ` Minwoo Im
2020-07-29 22:06 ` [PATCH v2 02/16] hw/block/nvme: add mapping helpers Klaus Jensen
2020-07-29 22:06 ` [PATCH v2 03/16] hw/block/nvme: replace dma_acct with blk_acct equivalent Klaus Jensen
2020-07-29 22:06 ` [PATCH v2 04/16] hw/block/nvme: remove redundant has_sg member Klaus Jensen
2020-07-30 10:15 ` Minwoo Im
2020-07-30 10:43 ` Maxim Levitsky
2020-07-29 22:06 ` [PATCH v2 05/16] hw/block/nvme: destroy request iov before reuse Klaus Jensen
2020-07-30 10:16 ` Minwoo Im
2020-07-30 10:43 ` Maxim Levitsky
2020-07-29 22:06 ` [PATCH v2 06/16] hw/block/nvme: refactor dma read/write Klaus Jensen
2020-07-29 22:06 ` [PATCH v2 07/16] hw/block/nvme: add tracing to nvme_map_prp Klaus Jensen
2020-07-30 10:17 ` Minwoo Im
2020-07-30 10:45 ` Maxim Levitsky
2020-07-29 22:06 ` [PATCH v2 08/16] hw/block/nvme: add request mapping helper Klaus Jensen
2020-07-30 10:19 ` Minwoo Im
2020-07-29 22:06 ` [PATCH v2 09/16] hw/block/nvme: verify validity of prp lists in the cmb Klaus Jensen
2020-07-29 22:06 ` Klaus Jensen [this message]
2020-07-29 22:06 ` [PATCH v2 11/16] hw/block/nvme: add check for mdts Klaus Jensen
2020-07-29 22:06 ` [PATCH v2 12/16] hw/block/nvme: be consistent about zeros vs zeroes Klaus Jensen
2020-07-29 22:06 ` [PATCH v2 13/16] hw/block/nvme: add ns/cmd references in NvmeRequest Klaus Jensen
2020-07-29 22:06 ` [PATCH v2 14/16] hw/block/nvme: consolidate qsg/iov clearing Klaus Jensen
2020-07-30 10:31 ` Minwoo Im
2020-07-30 11:02 ` Maxim Levitsky
2020-07-30 11:09 ` Klaus Jensen
2020-07-30 12:26 ` Minwoo Im
2020-07-29 22:06 ` [PATCH v2 15/16] hw/block/nvme: use preallocated qsg/iov in nvme_dma_prp Klaus Jensen
2020-07-30 10:29 ` Minwoo Im
2020-07-29 22:06 ` [PATCH v2 16/16] hw/block/nvme: remove explicit qsg/iov parameters Klaus Jensen
2020-07-30 10:30 ` Minwoo Im
2020-07-30 11:03 ` Maxim Levitsky
2020-08-17 6:45 ` [PATCH v2 00/16] hw/block/nvme: dma handling and address mapping cleanup Klaus Jensen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200729220638.344477-11-its@irrelevant.dk \
--to=its@irrelevant.dk \
--cc=andrzej.jakowski@linux.intel.com \
--cc=fam@euphon.net \
--cc=k.jensen@samsung.com \
--cc=kbusch@kernel.org \
--cc=kwolf@redhat.com \
--cc=minwoo.im.dev@gmail.com \
--cc=mlevitsk@redhat.com \
--cc=mreitz@redhat.com \
--cc=qemu-block@nongnu.org \
--cc=qemu-devel@nongnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).