qemu-devel.nongnu.org archive mirror
 help / color / mirror / Atom feed
From: Klaus Jensen <its@irrelevant.dk>
To: qemu-devel@nongnu.org
Cc: Kevin Wolf <kwolf@redhat.com>, Fam Zheng <fam@euphon.net>,
	qemu-block@nongnu.org, Klaus Jensen <k.jensen@samsung.com>,
	Max Reitz <mreitz@redhat.com>, Klaus Jensen <its@irrelevant.dk>,
	Minwoo Im <minwoo.im.dev@gmail.com>,
	Stefan Hajnoczi <stefanha@redhat.com>,
	Keith Busch <kbusch@kernel.org>
Subject: [PULL for-6.0 v2 09/10] hw/block/nvme: fix assert crash in nvme_subsys_ns
Date: Wed,  7 Apr 2021 07:46:34 +0200	[thread overview]
Message-ID: <20210407054635.189440-10-its@irrelevant.dk> (raw)
In-Reply-To: <20210407054635.189440-1-its@irrelevant.dk>

From: Klaus Jensen <k.jensen@samsung.com>

nvme_subsys_ns() is used in contexts where the namespace identifier is
taken from an untrusted source. Commit 3921756dee6d ("hw/block/nvme:
assert namespaces array indices") tried to guard against this by
introducing an assert on the namespace identifier.

This is wrong since it is perfectly valid to call the function with an
invalid namespace identifier and like nvme_ns(), nvme_subsys_ns() should
simply return NULL.

Fixes: 3921756dee6d ("hw/block/nvme: assert namespaces array indices")
Fixes: 94d8d6d16781 ("hw/block/nvme: support allocated namespace type")
Cc: Minwoo Im <minwoo.im.dev@gmail.com>
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
Reviewed-by: Minwoo Im <minwoo.im.dev@gmail.com>
 hw/block/nvme-subsys.h | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/hw/block/nvme-subsys.h b/hw/block/nvme-subsys.h
index 24132edd005c..1cbcad9be23e 100644
--- a/hw/block/nvme-subsys.h
+++ b/hw/block/nvme-subsys.h
@@ -49,12 +49,10 @@ static inline NvmeCtrl *nvme_subsys_ctrl(NvmeSubsystem *subsys,
 static inline NvmeNamespace *nvme_subsys_ns(NvmeSubsystem *subsys,
         uint32_t nsid)
-    if (!subsys) {
+    if (!subsys || !nsid || nsid > NVME_MAX_NAMESPACES) {
         return NULL;
-    assert(nsid && nsid <= NVME_MAX_NAMESPACES);
     return subsys->namespaces[nsid];

  parent reply	other threads:[~2021-04-07  5:54 UTC|newest]

Thread overview: 13+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-04-07  5:46 [PULL for-6.0 v2 00/10] emulated nvme fixes for -rc3 Klaus Jensen
2021-04-07  5:46 ` [PULL for-6.0 v2 01/10] hw/block/nvme: fix pi constraint check Klaus Jensen
2021-04-07  5:46 ` [PULL for-6.0 v2 02/10] hw/block/nvme: fix missing string representation for ns attachment Klaus Jensen
2021-04-07  5:46 ` [PULL for-6.0 v2 03/10] hw/block/nvme: fix the nsid 'invalid' value Klaus Jensen
2021-04-07  5:46 ` [PULL for-6.0 v2 04/10] hw/block/nvme: fix warning about legacy namespace configuration Klaus Jensen
2021-04-07  5:46 ` [PULL for-6.0 v2 05/10] hw/block/nvme: update dmsrl limit on namespace detachment Klaus Jensen
2021-04-07  5:46 ` [PULL for-6.0 v2 06/10] hw/block/nvme: fix handling of private namespaces Klaus Jensen
2021-04-07  5:46 ` [PULL for-6.0 v2 07/10] hw/block/nvme: add missing copyright headers Klaus Jensen
2021-04-07  5:46 ` [PULL for-6.0 v2 08/10] hw/block/nvme: fix ns attachment out-of-bounds read Klaus Jensen
2021-04-07  5:46 ` Klaus Jensen [this message]
2021-04-07  5:46 ` [PULL for-6.0 v2 10/10] hw/block/nvme: fix out-of-bounds read in nvme_subsys_ctrl Klaus Jensen
2021-04-07  8:03 ` [PULL for-6.0 v2 00/10] emulated nvme fixes for -rc3 Peter Maydell
2021-04-07  8:45   ` Klaus Jensen

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210407054635.189440-10-its@irrelevant.dk \
    --to=its@irrelevant.dk \
    --cc=fam@euphon.net \
    --cc=k.jensen@samsung.com \
    --cc=kbusch@kernel.org \
    --cc=kwolf@redhat.com \
    --cc=minwoo.im.dev@gmail.com \
    --cc=mreitz@redhat.com \
    --cc=qemu-block@nongnu.org \
    --cc=qemu-devel@nongnu.org \
    --cc=stefanha@redhat.com \


* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).