From nobody Mon Feb 23 00:43:01 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1593462949; cv=none; d=zohomail.com; s=zohoarc; b=Dvh4LnJIyRJLLD64f/NpozdIe+nb82qg4mDtvb/6Q5gV592nqLx9RL/5z9XtKWkee2upNW/86TADDaiblOl+nBvmKyTHD5LkQLwFPmFNrubZDjbC1wH773HBfJ2B+pEaThHK/VhAf1FlhjhVqehBljMAxjxjUd+LFLZTWwFft8M= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1593462949; h=Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:To; bh=pMxoUWSpGyJGEYlJmezHCmGdqN4mWNyjT4NBBc56fac=; b=MfpL4EtBWALzlUWVYkPP4yokCnLMOLPQxXhLR/eJTr9UlX3948AXW83xctZs6Fflfd396QpefULcowu6jinHEtnsUlDisLGBfDkKlgemVb0RA7PR+qWy8L+3i6YNHQTgQxm96gwdjc5M+WQyECUdkQnC2a1liuT5s2p4WZWt1n4= ARC-Authentication-Results: i=1; mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1593462949628233.16259552449776; Mon, 29 Jun 2020 13:35:49 -0700 (PDT) Received: from localhost ([::1]:39638 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1jq0VI-000880-Dh for importer@patchew.org; Mon, 29 Jun 2020 16:35:48 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:40030) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1jq0S0-0004BL-4I; Mon, 29 Jun 2020 16:32:24 -0400 Received: from charlie.dont.surf ([128.199.63.193]:46332) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1jq0Rt-000480-N3; Mon, 29 Jun 2020 16:32:23 -0400 Received: from apples.local (80-167-98-190-cable.dk.customer.tdc.net [80.167.98.190]) by charlie.dont.surf (Postfix) with ESMTPSA id 0F411BF724; Mon, 29 Jun 2020 20:32:14 +0000 (UTC) From: Klaus Jensen To: qemu-block@nongnu.org Subject: [PATCH 1/3] hw/block/nvme: harden cmb access Date: Mon, 29 Jun 2020 22:31:53 +0200 Message-Id: <20200629203155.1236860-2-its@irrelevant.dk> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20200629203155.1236860-1-its@irrelevant.dk> References: <20200629203155.1236860-1-its@irrelevant.dk> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=128.199.63.193; envelope-from=its@irrelevant.dk; helo=charlie.dont.surf X-detected-operating-system: by eggs.gnu.org: First seen = 2020/06/29 14:26:53 X-ACL-Warn: Detected OS = Linux 3.11 and newer [fuzzy] X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=_AUTOLEARN X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Kevin Wolf , Klaus Jensen , qemu-devel@nongnu.org, Max Reitz , Klaus Jensen , Keith Busch , Maxim Levitsky Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" Content-Type: text/plain; charset="utf-8" From: Klaus Jensen Since the controller has only supported PRPs so far it has not been required to check the ending address (addr + len - 1) of the CMB access for validity since it has been guaranteed to be in range of the CMB. This changes when the controller adds support for SGLs (next patch), so add that check. Signed-off-by: Klaus Jensen --- hw/block/nvme.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/hw/block/nvme.c b/hw/block/nvme.c index 94f5bf2a815f..191732692248 100644 --- a/hw/block/nvme.c +++ b/hw/block/nvme.c @@ -91,7 +91,12 @@ static bool nvme_addr_is_cmb(NvmeCtrl *n, hwaddr addr) =20 static int nvme_addr_read(NvmeCtrl *n, hwaddr addr, void *buf, int size) { - if (n->bar.cmbsz && nvme_addr_is_cmb(n, addr)) { + hwaddr hi =3D addr + size - 1; + if (hi < addr) { + return 1; + } + + if (n->bar.cmbsz && nvme_addr_is_cmb(n, addr) && nvme_addr_is_cmb(n, h= i)) { memcpy(buf, nvme_addr_to_cmb(n, addr), size); return 0; } --=20 2.27.0