From: Klaus Jensen <k.jensen@samsung.com>

Cross-namespace copy requires the source and destination namespace to
have the same logical block size. This is not verified, causing a heap
out-of-bounds write.

Fix by correctly identifying the invalid operation.

Cc: qemu-stable@nongnu.org
Reported-by: Feng Xue and XGPT of ThreatBook
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4173
Fixes: d522aef88d42 ("hw/nvme: add cross namespace copy support")
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
---
 hw/nvme/ctrl.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c
index 578421c21761..b48bf599b5d6 100644
--- a/hw/nvme/ctrl.c
+++ b/hw/nvme/ctrl.c
@@ -3277,6 +3277,11 @@ static void nvme_do_copy(NvmeCopyAIOCB *iocb)
         status = NVME_INVALID_FIELD | NVME_DNR;
         goto invalid;
     } else if (snsid != dnsid) {
+        if (sns->lbaf.ds != dns->lbaf.ds) {
+            status = NVME_CMD_INCOMP_NS_OR_FMT | NVME_DNR;
+            goto invalid;
+        }
+
         if (!NVME_ID_NS_DPS_TYPE(sns->id_ns.dps) &&
             !NVME_ID_NS_DPS_TYPE(dns->id_ns.dps)) {
             if (!nvme_copy_matching_ns_format(sns, dns, false)) {

---
base-commit: 8967b2fe1b2aaae3c29e207d85fab901d580a2dc
change-id: 20261021-fix-4173-d188c1a2ffdf

Best regards,
--  
Klaus Jensen <k.jensen@samsung.com>