From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:60077) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bxv7I-0005EO-DB for qemu-devel@nongnu.org; Sat, 22 Oct 2016 08:09:37 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bxv7H-00058Z-Fr for qemu-devel@nongnu.org; Sat, 22 Oct 2016 08:09:36 -0400 From: P J P Date: Sat, 22 Oct 2016 17:39:17 +0530 Message-Id: <1477138157-22337-1-git-send-email-ppandit@redhat.com> Subject: [Qemu-devel] [PATCH] block: nvme: correct the nvme queue id check List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Qemu Developers Cc: Keith Busch , qemu-block@nongnu.org, Qinghao Tang , Prasad J Pandit From: Prasad J Pandit NVME Express Controller has two queues, submission & completion queue. When creating a new queue object, 'nvme_create_sq' and 'nvme_create_cq' routines incorrectly check the queue id field. It could lead to an OOB access issue. Correct the queue id check to avoid it. Reported-by: Qinghao Tang Signed-off-by: Prasad J Pandit --- hw/block/nvme.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/hw/block/nvme.c b/hw/block/nvme.c index 2ded247..61bdc9d 100644 --- a/hw/block/nvme.c +++ b/hw/block/nvme.c @@ -373,7 +373,7 @@ static uint16_t nvme_create_sq(NvmeCtrl *n, NvmeCmd *cmd) if (!cqid || nvme_check_cqid(n, cqid)) { return NVME_INVALID_CQID | NVME_DNR; } - if (!sqid || (sqid && !nvme_check_sqid(n, sqid))) { + if (!sqid || nvme_check_sqid(n, sqid)) { return NVME_INVALID_QID | NVME_DNR; } if (!qsize || qsize > NVME_CAP_MQES(n->bar.cap)) { @@ -447,7 +447,7 @@ static uint16_t nvme_create_cq(NvmeCtrl *n, NvmeCmd *cmd) uint16_t qflags = le16_to_cpu(c->cq_flags); uint64_t prp1 = le64_to_cpu(c->prp1); - if (!cqid || (cqid && !nvme_check_cqid(n, cqid))) { + if (!cqid || nvme_check_cqid(n, cqid)) { return NVME_INVALID_CQID | NVME_DNR; } if (!qsize || qsize > NVME_CAP_MQES(n->bar.cap)) { -- 2.7.4