motorhead/qemu
1
0
Fork 0
mirror of https://github.com/Motorhead1991/qemu.git synced 2025-08-02 15:23:53 -06:00
Code Issues Projects Releases Packages Wiki Activity Actions

block/nvme: nvme_process_completion() fix bound for cid

Browse source 
NVMeQueuePair::reqs has length NVME_NUM_REQS, which less than
NVME_QUEUE_SIZE by 1.

Fixes: 1086e95da1 ("block/nvme: switch to a NVMeRequest freelist")
Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Maksim Davydov <davydov-max@yandex-team.ru>
Message-id: 20231017125941.810461-5-vsementsov@yandex-team.ru
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
This commit is contained in:
Vladimir Sementsov-Ogievskiy 2023-11-06 15:00:28 +00:00 • committed by Peter Maydell
parent 394bca2fa4
commit cc8fb0c3ae
1 changed files with 4 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

7
block/nvme.c
View file

@ -417,9 +417,10 @@ static bool nvme_process_completion(NVMeQueuePair *q)
q->cq_phase = !q->cq_phase; q->cq_phase = !q->cq_phase;
} }
cid = le16_to_cpu(c->cid); cid = le16_to_cpu(c->cid);
if (cid == 0 || cid > NVME_QUEUE_SIZE) { if (cid == 0 || cid > NVME_NUM_REQS) {
warn_report("NVMe: Unexpected CID in completion queue: %"PRIu32", " warn_report("NVMe: Unexpected CID in completion queue: %" PRIu32
"queue size: %u", cid, NVME_QUEUE_SIZE); ", should be within: 1..%u inclusively", cid,
NVME_NUM_REQS);
continue; continue;
} }
trace_nvme_complete_command(s, q->index, cid); trace_nvme_complete_command(s, q->index, cid);