Re: [PATCH] hw/nvme: fix CVE-2021-3929

[Klaus Jensen <its@irrelevant.dk>]

[-- Attachment #1: Type: text/plain, Size: 765 bytes --]

On Jan 20 07:10, Keith Busch wrote:
> On Thu, Jan 20, 2022 at 09:01:55AM +0100, Klaus Jensen wrote:
> > +static inline bool nvme_addr_is_iomem(NvmeCtrl *n, hwaddr addr)
> > +{
> > +    hwaddr hi, lo;
> > +
> > +    lo = n->bar0.addr;
> > +    hi = lo + int128_get64(n->bar0.size);
> > +
> > +    return addr >= lo && addr < hi;
> 
> Looks fine considering this implementation always puts CMB in an
> exclusive BAR. From a spec consideration though, you can put a CMB at a
> BAR0 offset. I don't think that's going to happen anytime soon here, but
> may be worth a comment to notify this function needs to be updated if
> that assumption ever changes.
> 
> Reviewed-by: Keith Busch <kbusch@kernel.org>

Nice catch Keith. A comment would be wise!

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]