Re: [PATCH] hw/nvme: verify source and destination lba size for copy

[Jesper Wendel Devantier <foss@defmacro.it>]

On 2026-10-21T15:37:46+02:00, Klaus Jensen <its@irrelevant.dk> wrote:
> From: Klaus Jensen <k.jensen@samsung.com>
>
> Cross-namespace copy requires the source and destination namespace to
> have the same logical block size. This is not verified, causing a heap
> out-of-bounds write.
>
> Fix by correctly identifying the invalid operation.
>
> Cc: qemu-stable@nongnu.org
> Reported-by: Feng Xue and XGPT of ThreatBook
> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4173
> Fixes: d522aef88d42 ("hw/nvme: add cross namespace copy support")
> Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
> ---
>  hw/nvme/ctrl.c | 5 +++++
>  1 file changed, 5 insertions(+)
>
> diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c
> index 578421c21761..b48bf599b5d6 100644
> --- a/hw/nvme/ctrl.c
> +++ b/hw/nvme/ctrl.c
> @@ -3277,6 +3277,11 @@ static void nvme_do_copy(NvmeCopyAIOCB *iocb)
>          status = NVME_INVALID_FIELD | NVME_DNR;
>          goto invalid;
>      } else if (snsid != dnsid) {
> +        if (sns->lbaf.ds != dns->lbaf.ds) {
> +            status = NVME_CMD_INCOMP_NS_OR_FMT | NVME_DNR;
> +            goto invalid;
> +        }
> +
>          if (!NVME_ID_NS_DPS_TYPE(sns->id_ns.dps) &&
>              !NVME_ID_NS_DPS_TYPE(dns->id_ns.dps)) {
>              if (!nvme_copy_matching_ns_format(sns, dns, false)) {
>
> ---
> base-commit: 8967b2fe1b2aaae3c29e207d85fab901d580a2dc
> change-id: 20261021-fix-4173-d188c1a2ffdf
>
> Best regards,
> --  
> Klaus Jensen <k.jensen@samsung.com>
>
>
>

Reviewed-by: Jesper Wendel Devantier <foss@defmacro.it>