From nobody Mon Sep 28 02:00:26 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1785261679; cv=none; d=zohomail.com; s=zohoarc; b=mjhlmOHQYXKu0tUnmYEysQghan+hZ/L8mZfIkopLsyl36qBuQSKBqQHDzfYkZpeDpfPWXf3rq3lBU0IAYIDDJ0TjHKiAllV03FVc4JFNspsSAX+nQ5wPlVj5FhQ1We2S+e1w9gMQSXeYS2l0Qk/WjR0FH77K2h4fWLz1oNQ8qCg= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785261679; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=N3AjwQ2YXrOmvBgcUI67g7DlkOf8MSg692sYg8/6/U8=; b=XtXB/mOEvWa+PhUr2JIlxlxIh7qGsF3gUKH0srNP2Kq9nkqYALwBLhtSziMvlIMaFWWnr3Ag24RjpownOMvD4HDYaCkoPvzjUPWmhwNYrCVyIg6GsGACBCcejFeZDg359uTR+7OWXU6c14u2F1rKtzQsd9k4xrurDcJV+qbEOwA= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785261679950177.0018031526588; Tue, 28 Jul 2026 11:01:19 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wom6Y-0004TK-TF; Tue, 28 Jul 2026 14:00:38 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wom6R-0004QL-TB; Tue, 28 Jul 2026 14:00:32 -0400 Received: from fout-a3-smtp.messagingengine.com ([103.168.172.146]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wom6P-0001WE-Vq; Tue, 28 Jul 2026 14:00:31 -0400 Received: from phl-compute-05.internal (phl-compute-05.internal [10.202.2.45]) by mailfout.phl.internal (Postfix) with ESMTP id 88DF2EC03E9; Tue, 28 Jul 2026 14:00:28 -0400 (EDT) Received: from phl-frontend-04 ([10.202.2.163]) by phl-compute-05.internal (MEProxy); Tue, 28 Jul 2026 14:00:28 -0400 Received: by mail.messagingengine.com (Postfix) with ESMTPA; Tue, 28 Jul 2026 14:00:26 -0400 (EDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=irrelevant.dk; h=cc:cc:content-transfer-encoding:content-type:date:date:from :from:in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:subject:subject:to:to; s=fm1; t=1785261628; x= 1785348028; bh=N3AjwQ2YXrOmvBgcUI67g7DlkOf8MSg692sYg8/6/U8=; b=K MWbqE8nbTWEkEBQz8dUKxRZaSu5qTNU/cguLCiiRXkK2MmsoP6YY7nUl5HswdvLo sIlHRtSK8WQ2/dYWw8+lo+xNbMhdd9t77L7OvVzdnrUkWT8cQ7RRQmurBdEFc40E Zto4Jchd0jQyk+aw2ihlc5wFRUUrOc09l+rygonSfvB+OLFyaysSLDK7A68LcSsU 92yNgHRrLYjwhcOHF9v8PpgiyhqBQTsu9Xkir93KX8CnUgKlGHquCHn/3o0wWFPr RNF1TBsXnMISU0gvUaY5+2aUkDCdXnvNAVebEsixwQ2kfdjxh7kC9uhviU+HZxo5 1qCe9/bi8Nj0LFnbsqnHA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:date:date:feedback-id:feedback-id:from:from :in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:subject:subject:to:to:x-me-proxy:x-me-sender :x-me-sender:x-sasl-enc; s=fm2; t=1785261628; x=1785348028; bh=N 3AjwQ2YXrOmvBgcUI67g7DlkOf8MSg692sYg8/6/U8=; b=LmzaHa4Dnv0yGj66O A9vXRG5ObDcufpBYLcJ5tmM0pSDygcN4dY+b8E8nTgVQ2ObdJni1F74xtBEvntHa Vi5+PTRBVScVDm6Jczz6roIiYE9gS7p4rjWkDlkN11VN5IirSHfGU0OBo9bJtYQU /wnyZMv71+61vpiiet0F7YgyVp33mE/fXEiZ3bgJ/PV2qZsMlxpPgJM5afV0S8YH 4qmK7RloC3eJvN8OmdHzmPA5ugebbpO829oquFizhQcuZVZmeO9Hkyea9k/00JG/ 3RoAUZGkoHPb4rIwSyzm8iY8BqBuU6ehRm4eTcPzsXDG6LyzvDnYIIUbYGxqQuHx b1w4w== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: dmFkZTE+3hDLj3fhqmx2xVW/U2sM+l/4n8Sn6klj+qZ2iqjdmW4eucHD5k5TBFgLS9xjCq 3AKS7HvLJmPnWhELLGGSJWqeN03CJ9fsA/OohVLhj1E7BFjsETMhrdkEx/vNSgVFxpw3Bs xhYYUmzJ6Jl2BqypFDmF/69E9V2f9rIe5bNvXVMCa4QGnFL/+itcI3ycHE53rOaEoHF8Z0 Rgcsgg12Xr7OD0YP/WQ+/lcqHdUTJYFTpdir9bQtwN0tRU1u5lvqJ4XizGq+m7GvoRLnhH icC65qISA/oMUgTjlMJZ9qqHF+WWxcp2O9D8i57nDJStdXrfOCKEeQOcpjVFgPZBWFB9jA xvijsaIzzcMac7nN0a1v1cSiEsxVh0KRYG+JWTKoRvpeV9WFhaozY++BqEEIr3JNL+lW1p i6B025llb6pfeHCEJTxLIm178vziE6efZRIs00gNEK/DiW10zrZ/Wca05PflzLA/NwGtjl AonTqlTRcAfa762H9S+HXGEigkPOmN4INU+l/kmZv3ElRrUpKl7+fU91e5i16v4BUqP3di KyZnNs7hUMATYGs7EhhJAjo8OMt5Ib0C3kRACGegx/UcNm3TJ72C4dseJQcSuMf4m0/2qr TdEYgXYZ2K83PweT06Z1JRHiiQsY3t6M+77fwTfThroJ0Z7BiJFf1lVVRaAA X-ME-Proxy: Feedback-ID: idc91472f:Fastmail From: Klaus Jensen To: qemu-devel@nongnu.org Cc: Peter Maydell , Alexander Mikhalitsyn , Klaus Jensen , Keith Busch , Klaus Jensen , Jesper Devantier , qemu-block@nongnu.org Subject: [PULL 1/4] hw/nvme: use GPtrArray for blocker_features Date: Tue, 28 Jul 2026 20:00:15 +0200 Message-ID: <20260728180018.3574-2-its@irrelevant.dk> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260728180018.3574-1-its@irrelevant.dk> References: <20260728180018.3574-1-its@irrelevant.dk> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=103.168.172.146; envelope-from=its@irrelevant.dk; helo=fout-a3-smtp.messagingengine.com X-Spam_score_int: -27 X-Spam_score: -2.8 X-Spam_bar: -- X-Spam_report: (-2.8 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @irrelevant.dk) X-ZM-MESSAGEID: 1785261680750158500 Content-Type: text/plain; charset="utf-8" From: Alexander Mikhalitsyn Let's use GPtrArray to build a list of blocker features and then g_strjoinv() to build a final comma-delimited string. While previous approach was technically correct, it is fragile (because we need to take care of static buffer size choice) and Coverity dislikes it too. Note, that we use g_ptr_array_new() to allocate array which means that GDestroyNotify callback is not set, so we can pass pointers to a static memory like g_ptr_array_add(..., (gpointer) "SR-IOV") without any problems as there won't be any attempt to free that memory. Resolves: Coverity CID 1663673 Suggested-by: Peter Maydell Signed-off-by: Alexander Mikhalitsyn Reviewed-by: Peter Maydell Reviewed-by: Klaus Jensen [k.jensen: change cast from gpointer to void ptr] Signed-off-by: Klaus Jensen --- hw/nvme/ctrl.c | 41 +++++++++++++++++------------------------ 1 file changed, 17 insertions(+), 24 deletions(-) diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c index a67e1598891c..086048b689d3 100644 --- a/hw/nvme/ctrl.c +++ b/hw/nvme/ctrl.c @@ -9352,22 +9352,11 @@ static void nvme_init_ctrl(NvmeCtrl *n, PCIDevice *= pci_dev) } } =20 -#define BLOCKER_FEATURES_MAX_LEN 256 - -static inline void nvme_add_blocker_feature(char *blocker_features, - const char *feature) -{ - if (strlen(blocker_features) > 0) { - g_strlcat(blocker_features, ", ", BLOCKER_FEATURES_MAX_LEN); - } - g_strlcat(blocker_features, feature, BLOCKER_FEATURES_MAX_LEN); -} - static bool nvme_set_migration_blockers(NvmeCtrl *n, PCIDevice *pci_dev, Error **errp) { uint64_t unsupported_cap, cap =3D ldq_le_p(&n->bar.cap); - char blocker_features[BLOCKER_FEATURES_MAX_LEN] =3D ""; + g_autoptr(GPtrArray) blocker_features =3D g_ptr_array_new(); bool adm_cmd_security_checked =3D false; bool cmd_io_mgmt_checked =3D false; bool cmd_zone_checked =3D false; @@ -9416,15 +9405,15 @@ static bool nvme_set_migration_blockers(NvmeCtrl *n= , PCIDevice *pci_dev, } =20 if (namespaces_num > 1) { - nvme_add_blocker_feature(blocker_features, - "Namespace Attachment"); + g_ptr_array_add(blocker_features, + (void *) "Namespace Attachment"); } =20 break; } case NVME_ADM_CMD_VIRT_MNGMT: if (n->params.sriov_max_vfs) { - nvme_add_blocker_feature(blocker_features, "SR-IOV"); + g_ptr_array_add(blocker_features, (void *) "SR-IOV"); } =20 break; @@ -9435,7 +9424,7 @@ static bool nvme_set_migration_blockers(NvmeCtrl *n, = PCIDevice *pci_dev, } =20 if (pci_dev->spdm_port) { - nvme_add_blocker_feature(blocker_features, "SPDM"); + g_ptr_array_add(blocker_features, (void *) "SPDM"); } =20 adm_cmd_security_checked =3D true; @@ -9469,7 +9458,7 @@ static bool nvme_set_migration_blockers(NvmeCtrl *n, = PCIDevice *pci_dev, =20 /* check for NVME_IOMS_MO_RUH_UPDATE */ if (n->subsys->params.fdp.enabled) { - nvme_add_blocker_feature(blocker_features, "FDP"); + g_ptr_array_add(blocker_features, (void *) "FDP"); } =20 cmd_io_mgmt_checked =3D true; @@ -9504,8 +9493,8 @@ static bool nvme_set_migration_blockers(NvmeCtrl *n, = PCIDevice *pci_dev, } =20 if (ns->params.zoned) { - nvme_add_blocker_feature(blocker_features, - "Zoned Namespace"); + g_ptr_array_add(blocker_features, + (void *) "Zoned Namespace"); break; } } @@ -9525,24 +9514,28 @@ static bool nvme_set_migration_blockers(NvmeCtrl *n= , PCIDevice *pci_dev, * covered by unsupported_cap check. */ if (NVME_CAP_CMBS(cap)) { - nvme_add_blocker_feature(blocker_features, "CMB"); + g_ptr_array_add(blocker_features, (void *) "CMB"); cap &=3D ~((uint64_t)CAP_CMBS_MASK << CAP_CMBS_SHIFT); } =20 if (NVME_CAP_PMRS(cap)) { - nvme_add_blocker_feature(blocker_features, "PMR"); + g_ptr_array_add(blocker_features, (void *) "PMR"); cap &=3D ~((uint64_t)CAP_PMRS_MASK << CAP_PMRS_SHIFT); } =20 unsupported_cap =3D cap & ~NVME_MIGRATION_SUPPORTED_CAP_BITS; if (unsupported_cap) { - nvme_add_blocker_feature(blocker_features, "unknown capability"); + g_ptr_array_add(blocker_features, (void *) "unknown capability"); } =20 assert(n->migration_blocker =3D=3D NULL); - if (strlen(blocker_features) > 0) { + if (blocker_features->len > 0) { + g_autofree char *blocker_list =3D NULL; + + g_ptr_array_add(blocker_features, NULL); + blocker_list =3D g_strjoinv(", ", (void *)blocker_features->pdata); error_setg(&n->migration_blocker, - "Migration is not supported for %s", blocker_features); + "Migration is not supported for %s", blocker_list); if (migrate_add_blocker(&n->migration_blocker, errp) < 0) { return false; } --=20 2.53.0 From nobody Mon Sep 28 02:00:26 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1785261680; cv=none; d=zohomail.com; s=zohoarc; b=GjH8QxUci1bxcvvCyZXSMhApN3Q+Nda0UGKGjXOi4RB4Q9oJm35odyf37hOzfu05445En/o6fkQBkmVDvXJHegrchy0JOfBy0v6NwXD8A2z9xltaMK1sZH5yMCk390MkWze4qtDMGXkhawpBweL+JmZilcBZvtpsjOaqcDtin6Y= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785261680; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=0UxCNZQ9F7PlpoN+MQGsJgZorVksKnCQBGgUNpiTpCM=; b=RdtwYu6X0dwlksvJBaJl931jFi0cpkzzHhccPS594uHPyhK0i7b7BCJ0PkbOSRIkSzt1CC74vf1rg6ydZnTIhZTtYnOvIifHvUD/Tl/FL11Bub4Vp+k8BjgqRajiAC9vQgi2Ot1sDHO51d2hPWCYnFRM9V02aduwCzIQ8391IjQ= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785261679950609.7163438136646; Tue, 28 Jul 2026 11:01:19 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wom6T-0004Qw-Tm; Tue, 28 Jul 2026 14:00:33 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wom6S-0004QN-Hv; Tue, 28 Jul 2026 14:00:32 -0400 Received: from fout-a3-smtp.messagingengine.com ([103.168.172.146]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wom6Q-0001WS-UZ; Tue, 28 Jul 2026 14:00:32 -0400 Received: from phl-compute-06.internal (phl-compute-06.internal [10.202.2.46]) by mailfout.phl.internal (Postfix) with ESMTP id 2C924EC03EB; Tue, 28 Jul 2026 14:00:30 -0400 (EDT) Received: from phl-frontend-04 ([10.202.2.163]) by phl-compute-06.internal (MEProxy); Tue, 28 Jul 2026 14:00:30 -0400 Received: by mail.messagingengine.com (Postfix) with ESMTPA; Tue, 28 Jul 2026 14:00:28 -0400 (EDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=irrelevant.dk; h=cc:cc:content-transfer-encoding:content-type:date:date:from :from:in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:subject:subject:to:to; s=fm1; t=1785261630; x= 1785348030; bh=0UxCNZQ9F7PlpoN+MQGsJgZorVksKnCQBGgUNpiTpCM=; b=F +GwSO3NcxyopVwHYgMfUHr0j4KDe/4RlvRzy6dbIa7Qm6btrgz/HOdJ947bMOjLJ 6x0PuCB/QQMmJRn8GlLZN6su1zvvzs2jgebvXnJCuXlvT09wOd/XoolEep0fspS/ 13uYsrLk2idKRvpJq9nph9QgKcj68DLGQK2PYjd6JniJ5kH1Q8QNX5k6B2glcCec Q+Ple6vTsqcEc4+ppN75o5RGd7uMDkuU6Yw/UXmSWXGFuMZEijgQvhS5gBjqMY2d pSH0p+DE1T8ydAJJd64pGfg96q3Ymg9ECIQeQ8/tthfVkb8J3WDh/wjRGsOSCfBn reNUVVEsTRXEycgNltqAQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:date:date:feedback-id:feedback-id:from:from :in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:subject:subject:to:to:x-me-proxy:x-me-sender :x-me-sender:x-sasl-enc; s=fm2; t=1785261630; x=1785348030; bh=0 UxCNZQ9F7PlpoN+MQGsJgZorVksKnCQBGgUNpiTpCM=; b=RZ2gjOEf853HizKN3 esewiRQfTpSH7SVuu702WDergkRkzfdDcf0qC6K42SGVv4Kub6vyKQozkHSZfJe8 w5dMYktAmjlfye0Ur8h5ur15Z52QBLll6rstX0yCYVKfjenPqpwJEitB7mm6Mk0i s6AcAwcMJBa8H0y0Zyv6OxCkVxWV7kAF3gTArkBieSuM8LDSIX/mBK1YFLDzpdUg OK1pUUDGQBHeSFkBWrujcVwhFSSfKC+poEL8tcwWQQcFZnb+x5nWqnARPyOzqHJQ 1DIeoZfbIeuNZKf9bpGMOTju9dhtKCTMtIrJFlDc2dYXW4ma170nlS2pwYiFgJnw d4Ndw== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: dmFkZTGovHU/Jy6CaBk54R1jIRhdXQCresAX0TH0VZyvhNaiVWlMPM4rPBCdSOqWvkbaIG Tp7zicu7DdDOjRz1mKYuyOPyDUqaAeSVRg19DOStxJypRIygut5dT7XVtGw9uEcM/C78WV y2ctbyIIq/ryoYwSHEGyiStrj4fCgd8yMV0fASQFl1bE2dnVe8iW5tPSEoZA/fMzM23oyP St1TE3aXfu0mb2XYfELsXBtOIn6dpk8qrIODShZv1vCpqd97o2CzeBzY4znLZrWJdDEU37 CiT1d9w01x23+5FJKc4nck5OislmpYR+YOrwfddyRgXQlRyQBBF3CmidaJdwHe7RWSsRZT mVcV/LCjK3pd4s30j8xobyBZk5C1wfU4/DoSZB409UDHiL8rvwM3b5eLPHgA7hj6R/XKK2 dHen/1oCIUOQU3jqX8pB6e8GACv5ZxAdRP+h+CN2Y6i19mqdmBF48LVrBJmqeyXfxxUYDk j1YrsVG6DTJli+fC7HzT3ZLFWBXhIul2J04F//Vb1ONghEQbSxmDOFWweifL6rrouJMBt0 npOcjDY4jZWjLlu6r7hQiptUE0C/DpibELUcJCUfrG2wL08MAFXbmc6KrpXSghYnsUQ9IT 5y31DkjwXrkkLQez1P5TylnZa3QSyMBSOVRX66xxjDg1xuLm1FYDzZJzt8DA X-ME-Proxy: Feedback-ID: idc91472f:Fastmail From: Klaus Jensen To: qemu-devel@nongnu.org Cc: Peter Maydell , Daniel Paziyski , Klaus Jensen , Keith Busch , Klaus Jensen , Jesper Devantier , qemu-block@nongnu.org Subject: [PULL 2/4] hw/nvme: fix assertion failure on subregion removal Date: Tue, 28 Jul 2026 20:00:16 +0200 Message-ID: <20260728180018.3574-3-its@irrelevant.dk> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260728180018.3574-1-its@irrelevant.dk> References: <20260728180018.3574-1-its@irrelevant.dk> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=103.168.172.146; envelope-from=its@irrelevant.dk; helo=fout-a3-smtp.messagingengine.com X-Spam_score_int: -27 X-Spam_score: -2.8 X-Spam_bar: -- X-Spam_report: (-2.8 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @irrelevant.dk) X-ZM-MESSAGEID: 1785261682622158500 Content-Type: text/plain; charset="utf-8" From: Daniel Paziyski When a controller is created with a MSI-X exclusive BAR, the bar0 memory re= gion is not used at all, and so, the iomem region is not added as a subregion of= it. However, when removing a NVMe controller, the iomem region is unconditional= ly removed as a subregion of bar0, causing an assertion failure. Remove the io= mem memory region as a subregion of bar0 only if not using a MSI-X exclusive BA= R. QEMU options (requires a hotunplug-aware OS): -M q35 -device pcie-root-port,id=3Drp0 \ -device nvme,serial=3Dctrl0,id=3Dctrl0,bus=3Drp0,msix-exclusive-bar= =3Don In the QEMU monitor, or by causing an ejection from the OS: device_del ctrl0 Message in stderr: qemu-system-x86_64: ../system/memory.c:2617: memory_region_del_subregion: A= ssertion `subregion->container =3D=3D mr' failed. Fixes: fa905f65c554 ("hw/nvme: add machine compatibility parameter to enabl= e msix exclusive bar") Fixes: 9162f1012576 ("hw/nvme: fix msix_uninit with exclusive bar") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4090 Signed-off-by: Daniel Paziyski Reviewed-by: Klaus Jensen Signed-off-by: Klaus Jensen --- hw/nvme/ctrl.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c index 086048b689d3..e1639b3839f7 100644 --- a/hw/nvme/ctrl.c +++ b/hw/nvme/ctrl.c @@ -9703,10 +9703,9 @@ static void nvme_exit(PCIDevice *pci_dev) msix_uninit_exclusive_bar(pci_dev); } else { msix_uninit(pci_dev, &n->bar0, &n->bar0); + memory_region_del_subregion(&n->bar0, &n->iomem); } =20 - memory_region_del_subregion(&n->bar0, &n->iomem); - migrate_del_blocker(&n->migration_blocker); } =20 --=20 2.53.0 From nobody Mon Sep 28 02:00:26 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1785261712; cv=none; d=zohomail.com; s=zohoarc; b=JiIcUgWNM6hh0hHuwbdcUJhRyU23Bl55vj7uTHYKGdP2K1qTqtolHkRMSd/Wdn8Dk+ewxNXZVK+gceS2HbMZs68yTNFQ22SL6YPPNxjJUFPEBSThbQllqwTpsra4K+6AkKiObLTn/N34nxSb7SLxQmQTzYZEQwIU6Gt7EX1bw2A= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785261712; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=p3HPNeu+aHFrrJk+v9+jgkacqq2akWMFc3V3H8X2mkk=; b=OzH20Gv7EeNOxO4GeeVpO8/Vj9V825zWdqZRh6tioq56esWLU0ruOAazoqcxUtMXFMESr0WfDpYwDZ0aHkwHMq7+nEgP9DMzxQ0SotNC+DN48SO0HpzTUHhQhEu4mxo1p5loYgV6Si81VgyRDerQDNfCiYLvw4uMzv3MapvzdOI= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785261712601883.4876887660528; Tue, 28 Jul 2026 11:01:52 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wom6a-0004aY-DP; Tue, 28 Jul 2026 14:00:40 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wom6W-0004Tr-Ca; Tue, 28 Jul 2026 14:00:38 -0400 Received: from fhigh-a8-smtp.messagingengine.com ([103.168.172.159]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wom6U-0001Ww-BP; Tue, 28 Jul 2026 14:00:35 -0400 Received: from phl-compute-01.internal (phl-compute-01.internal [10.202.2.41]) by mailfhigh.phl.internal (Postfix) with ESMTP id D2A021400081; Tue, 28 Jul 2026 14:00:32 -0400 (EDT) Received: from phl-frontend-04 ([10.202.2.163]) by phl-compute-01.internal (MEProxy); Tue, 28 Jul 2026 14:00:32 -0400 Received: by mail.messagingengine.com (Postfix) with ESMTPA; Tue, 28 Jul 2026 14:00:30 -0400 (EDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=irrelevant.dk; h=cc:cc:content-transfer-encoding:content-type:content-type :date:date:from:from:in-reply-to:in-reply-to:message-id :mime-version:references:reply-to:subject:subject:to:to; s=fm1; t=1785261632; x=1785348032; bh=p3HPNeu+aHFrrJk+v9+jgkacqq2akWMF c3V3H8X2mkk=; b=rvDINbIZmhgsNeJGbuAsXFJAnjlNTShYU1lkuw5SB7UZeGgJ p8iON4cbfdIIVfLP6ssndyXn3IEWh8bpO3RZYPcw9fRWFr/2sBaJlAEJbKBJSkR0 HfzZw7hYkZAxHx0qumLcxnKFTnkTI7+L/q6ukB1N5PXk5TdtmBhapk12cwLIR/Ak Z3Msk1ZkLyQrOOSywTnB/pm856hbJIzse/fBq+RYBiqaqERZ4UVfN0t9nS07QBiR Dzh66uymXxwfB+6Qz2CoUZKk3aScKIRX1c6Mj6Yxj5LqAvK4QvhxdcDJQL72g5jo +9aUR6aZVxG51TPnU5Xo4ZszJchH9RfC+SiWMg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:content-type:date:date:feedback-id:feedback-id :from:from:in-reply-to:in-reply-to:message-id:mime-version :references:reply-to:subject:subject:to:to:x-me-proxy :x-me-sender:x-me-sender:x-sasl-enc; s=fm2; t=1785261632; x= 1785348032; bh=p3HPNeu+aHFrrJk+v9+jgkacqq2akWMFc3V3H8X2mkk=; b=j BLU8Megz/SNeQVRJRv2Fh0RmW86/cid8j5O4T1RR9xB8KqZrNW6tpaLZI5astGs6 vOtnKHNTYyPcEKatKJuZHMyPCiDl6EeCW8xZ3i7G94UcTs6Xv5srJoInHEQ6VTtk CyZky8fhI8AIgktIbrVz4a17F8pgoASnWWhjckut3oU3bygAJQsYBVSedqpqFgmh fZgN1BaZCB1S0wnRZjND6JhpDbtbrUJzJSWkBZueDcwZgnirIU5eSrlYq8F+KT+Q 5CxBI+jsIqiMDIRqHvuRyEm+YoqwQfA9/mH8XeIY5r0FuqXeLMdqWs0aZK4y76Y0 sN4rBxUoyJe6s8JRQaIcg== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: dmFkZTFocshqA88LTMiGWBA+maAGF21oBkmgGwtu1yypWYGnE8uPdno3TETbWkuDKQRKSo pFNpFTZmZWEeewnA9ZsX6E0LhYgMh7JQuvjNs0HUf0kPqX/vwYYRprMdK3uFzdEXlpXhlx /DsbRDS4OzMi7LmMBTkGH/ytZ7guloixqKsdtiHOqYWwTyD13c2a4jFsq/CTFwSxrtJHs1 XDSbpwRIh8VKfSs6MoIyfylsB15USzH92ZMKKbodtikHFKACmUPIvmDER0tSTmD5TJhBgH sCI7q0PYNzHmLlpZqhwgBeL87fulSHgWtT+8fhrop2C5qdTeadyZ+Pgh3bu7gu/ovwzvOx U1cI9E4u4+Q6HqA71R69G+/bDiOuJTKLl+oIVxwmQunEs5tOgiXlFqhdr2IfI3LISBXiJy 9OzMecTqA3sxr1Z6FaPtIcVfrnviGQdw6RZAQynziFRiSCUNmVKLZmoeE5EMDwBPIIk3KK hHBMGssot4JZ18G22PNQdQCFOoguWfv172I2nVhqcSpvGNvXglVFuX8gVHj1GyW2g0L5o9 o142FnyIWtPDlilWXQeUXkUKKMYYDZKcX5YR1LDHw1G5jhScrgk8jFZM1/DcIyjNg+ahRc H6KP8ofo2WGgHXozhN+Jt+Z4YcZZH2KGH/Vjj7NNkh0LscNUl1KdYnj+TWAQ X-ME-Proxy: Feedback-ID: idc91472f:Fastmail From: Klaus Jensen To: qemu-devel@nongnu.org Cc: Peter Maydell , Klaus Jensen , qemu-stable@nongnu.org, Jihe Wang , boy juju , contact , david korczynski , "Brian Chastain (off_by_one / Curious-Keeper)" , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Keith Busch , Klaus Jensen , Jesper Devantier , qemu-block@nongnu.org Subject: [PULL 3/4] hw/nvme: fix cross-namespace copy dif buffer overflow Date: Tue, 28 Jul 2026 20:00:17 +0200 Message-ID: <20260728180018.3574-4-its@irrelevant.dk> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260728180018.3574-1-its@irrelevant.dk> References: <20260728180018.3574-1-its@irrelevant.dk> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=103.168.172.159; envelope-from=its@irrelevant.dk; helo=fhigh-a8-smtp.messagingengine.com X-Spam_score_int: -27 X-Spam_score: -2.8 X-Spam_bar: -- X-Spam_report: (-2.8 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @irrelevant.dk) X-ZM-MESSAGEID: 1785261714556158500 From: Klaus Jensen The NVMe specification allows a controller with multiple namespaces to use different LBA formats per namespace. One implication of this is that the destination namespace may have a metadata area for PI, but the source does not. In that case, the controller shall generate the protection information, but the bounce buffer is erroneously allocated without space for that, causing a buffer overflow. Fix the allocation. Cc: qemu-stable@nongnu.org Fixes: d522aef88d42 ("hw/nvme: add cross namespace copy support") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3387 Reported-by: Jihe Wang Reported-by: boy juju Reported-by: contact Reported-by: david korczynski Reported-by: Brian Chastain (off_by_one / Curious-Keeper) Reviewed-by: Philippe Mathieu-Daud=C3=A9 Signed-off-by: Klaus Jensen --- hw/nvme/ctrl.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c index e1639b3839f7..acd10fcc67fa 100644 --- a/hw/nvme/ctrl.c +++ b/hw/nvme/ctrl.c @@ -3210,7 +3210,7 @@ static void nvme_do_copy(NvmeCopyAIOCB *iocb) uint16_t prinfow =3D ((copy->control[2] >> 2) & 0xf); uint64_t slba; uint32_t nlb; - size_t len; + size_t len, blen; uint16_t status; uint32_t dnsid =3D le32_to_cpu(req->cmd.nsid); uint32_t snsid =3D dnsid; @@ -3331,10 +3331,13 @@ static void nvme_do_copy(NvmeCopyAIOCB *iocb) } =20 g_free(iocb->bounce); - iocb->bounce =3D g_malloc_n(le16_to_cpu(sns->id_ns.mssrl), - sns->lbasz + sns->lbaf.ms); + assert(g_size_checked_mul(&blen, le16_to_cpu(sns->id_ns.mssrl), + sns->lbasz + MAX(sns->lbaf.ms, dns->lbaf.ms)= )); + + iocb->bounce =3D g_malloc(blen); =20 qemu_iovec_reset(&iocb->iov); + assert(len <=3D blen); qemu_iovec_add(&iocb->iov, iocb->bounce, len); =20 block_acct_start(blk_get_stats(sns->blkconf.blk), &iocb->acct.read, 0, --=20 2.53.0 From nobody Mon Sep 28 02:00:26 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1785261679; cv=none; d=zohomail.com; s=zohoarc; b=OlMdcY0rgQFawfrIhUkfQ1I3Z1brSJ3zyy5q42JUcK+6dgP4XCIHwk3w+r/X1R4YJRjpESeHHY9jLj1c/AS0o1kSoJq2jR3yRBHtUyMEcEMZfSa04Ck9KF2ZaW/CJQjKDSxs9A1Y4I1DjzCZtydRci/Rp401L0KVi3pM4d1dWzI= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785261679; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=/TtEQXPk16auxIOaY+Xnq34xyZiCgmr4O2lVrdENHxQ=; b=aaCOdR3+KxpWqBv3KI2gK8q47unIrZmomD8pcLV5VuTYGqTrD1qMAqu7D+aHeFFVL7bZqjTKq79noOpKcA0nnKCKYo+Q/BDjCJtyu/sH7KM1K1rU28wUs6z7PhFCxUZb0hHDgTe2OsYKLJ5Jby00+Yv9xTcQLGJrUVSLQ5ADZEs= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785261679877561.1072254414511; Tue, 28 Jul 2026 11:01:19 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wom6b-0004bg-69; Tue, 28 Jul 2026 14:00:41 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wom6X-0004U9-JV; Tue, 28 Jul 2026 14:00:38 -0400 Received: from fout-a3-smtp.messagingengine.com ([103.168.172.146]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wom6V-0001Xf-Sw; Tue, 28 Jul 2026 14:00:37 -0400 Received: from phl-compute-05.internal (phl-compute-05.internal [10.202.2.45]) by mailfout.phl.internal (Postfix) with ESMTP id A5A59EC03EB; Tue, 28 Jul 2026 14:00:34 -0400 (EDT) Received: from phl-frontend-04 ([10.202.2.163]) by phl-compute-05.internal (MEProxy); Tue, 28 Jul 2026 14:00:34 -0400 Received: by mail.messagingengine.com (Postfix) with ESMTPA; Tue, 28 Jul 2026 14:00:33 -0400 (EDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=irrelevant.dk; h=cc:cc:content-transfer-encoding:content-type:content-type :date:date:from:from:in-reply-to:in-reply-to:message-id :mime-version:references:reply-to:subject:subject:to:to; s=fm1; t=1785261634; x=1785348034; bh=/TtEQXPk16auxIOaY+Xnq34xyZiCgmr4 O2lVrdENHxQ=; b=k6Kj+p6PABr8scqutt3/3emTOXo2GaRUwed03aE0hs3vMTW9 rosc31BKyYMH5zzUlW3+ZhU+yu2MgR49jrLMIJkfo1J2ybgALSIbB+b1pmO3L+Mf PMX7xwDXu8lsC3AdCxu/7TRVO2iOFe7uByVODD8Sa7OooALtmzpyn1MxIteUQ0go i3x4fW0FFJPtz0ag6qJiQH6qpgeJtCWLmM4sHvo6mjCNB91bszJeHpmG/1HjtrQ5 tWHF56EKhyYmSLbXm3g2giTsb2Mc01hQHq9inN2iPvmtFyVgcHnZBgSpvLVojLq/ kFubZ7Vf/4yK3Hy6xm3Cm5PXBcqGYxPFOahR/g== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:content-type:date:date:feedback-id:feedback-id :from:from:in-reply-to:in-reply-to:message-id:mime-version :references:reply-to:subject:subject:to:to:x-me-proxy :x-me-sender:x-me-sender:x-sasl-enc; s=fm2; t=1785261634; x= 1785348034; bh=/TtEQXPk16auxIOaY+Xnq34xyZiCgmr4O2lVrdENHxQ=; b=i dgDuHkKSPjtmrjjF/qn/fWqTR508nMoo9fvLglMsNRIHk6ze7WE0fzuqeB1IQu3K eiluW8yN+4Ob/OjBLY4rXw4OJxETR4LlzSb0JEl+VX0jHqSaWu8UqBqdi2Rv4q+c OyzVY9xHbDPP6jPczlpOctwWReYWZ4XRIP1IGiI6Q0XGOR61fDOhb5Gnz5Lh67ny DKAN3JgbO3vXBkEyjDZfrVOR8eqqOUYMLJmLBgKGdUcQSB1HLOvkaN+A2Rl5i226 jjTCfycFuBU0YuToUl2MYOSGn2QbkxfVuC1Up34C/HznGfhJdJo0jC4mICwzhSuB yNQdfl8QKqwWKS2HIgU8Q== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: dmFkZTFObtFZ0S9XoA6JusdJFz/Dpr4TfI7w4J2+u3NKGWTHrUpO2Au3H29XjmsbbVfgUZ pOSlja/qDFIsPO5UBlnFGkOafmj8IgESJmVIyVH35db2pxDBz6HGywBEzXLBezr5pyG/1P 77+Ny2ne1a2rQL4qesFFaK9wZOhV9dLwtFUpCkOha8a25HmNc4WBCeTswNdjTOyOimuriW UCBCSOh7U9YqRwTDZstEFU5hrBqQtKTK6KJU+RqZ60azzRBmknC90baCGSIE4dUzb2mIb3 PFwWjSn2BRjk5PZuPZaRMrxSywOEhIYs/8CzmuBALgv883dhiEzZeCqgMsoQiB5o++l0Og uGiboYRqPZbiU2AbcU5HT2E/TNbPKA8nTgZznT/9VKmRlsRG8oUHvhCXdGSHtNYugDZff+ 81fraaxaRoO6wc5nCsdWXWB9Ll9uz0WvqZ+HajM919H4HhiRYm1H0NuVVsdgwht0gVJPz9 wtDj8rxpYW6TlUvCeKawwbdLKRQHmtRN0IFJ710ctcDNWAjXq+b+nBpOg335Q10eTtrDwS icoTCrm1NGA5PyifAOxo8tDEOT6rzudjwa5Kg0uQYg5beSK7SmpQqbGR5WqwYtWsL10iDc wkFUboA3/Vp0kJ/dnmnGIb6wB1CJF/Po2HNQOZ5xExhGF9wfYT0KeyMUxJLQ X-ME-Proxy: Feedback-ID: idc91472f:Fastmail From: Klaus Jensen To: qemu-devel@nongnu.org Cc: Peter Maydell , Klaus Jensen , qemu-stable@nongnu.org, =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Keith Busch , Klaus Jensen , Jesper Devantier , qemu-block@nongnu.org Subject: [PULL 4/4] hw/nvme: fix unintentional integer overflow in shift Date: Tue, 28 Jul 2026 20:00:18 +0200 Message-ID: <20260728180018.3574-5-its@irrelevant.dk> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260728180018.3574-1-its@irrelevant.dk> References: <20260728180018.3574-1-its@irrelevant.dk> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=103.168.172.146; envelope-from=its@irrelevant.dk; helo=fout-a3-smtp.messagingengine.com X-Spam_score_int: -27 X-Spam_score: -2.8 X-Spam_bar: -- X-Spam_report: (-2.8 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @irrelevant.dk) X-ZM-MESSAGEID: 1785261680701158500 From: Klaus Jensen Fix potentially overflowing shift operation. Cc: qemu-stable@nongnu.org Suggested-by: Peter Maydell Suggested-by: Philippe Mathieu-Daud=C3=A9 Resolves: Coverity CID 1663674 Fixes: ec917cd49918 ("hw/nvme: fix FDP set FDP events") Reviewed-by: Philippe Mathieu-Daud=C3=A9 Signed-off-by: Klaus Jensen --- hw/nvme/ctrl.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c index acd10fcc67fa..bd6ad64b2000 100644 --- a/hw/nvme/ctrl.c +++ b/hw/nvme/ctrl.c @@ -196,6 +196,7 @@ */ =20 #include "qemu/osdep.h" +#include "qemu/bitops.h" #include "qemu/cutils.h" #include "qemu/error-report.h" #include "qemu/log.h" @@ -6625,7 +6626,8 @@ static uint16_t nvme_set_feature_fdp_events(NvmeCtrl = *n, NvmeNamespace *ns, if (!shift && event_type) { continue; } - event_mask |=3D (1 << nvme_fdp_evf_shifts[events[i]]); + event_mask =3D + deposit64(event_mask, nvme_fdp_evf_shifts[events[i]], 1, 1); } =20 if (enable) { --=20 2.53.0