diff mbox series

[PULL,for-6.0,v2,09/10] hw/block/nvme: fix assert crash in nvme_subsys_ns

Message ID 20210407054635.189440-10-its@irrelevant.dk
State New
Headers show
Series [PULL,for-6.0,v2,01/10] hw/block/nvme: fix pi constraint check | expand

Commit Message

Klaus Jensen April 7, 2021, 5:46 a.m. UTC 
From: Klaus Jensen <k.jensen@samsung.com>

nvme_subsys_ns() is used in contexts where the namespace identifier is
taken from an untrusted source. Commit 3921756dee6d ("hw/block/nvme:
assert namespaces array indices") tried to guard against this by
introducing an assert on the namespace identifier.

This is wrong since it is perfectly valid to call the function with an
invalid namespace identifier and like nvme_ns(), nvme_subsys_ns() should
simply return NULL.

Fixes: 3921756dee6d ("hw/block/nvme: assert namespaces array indices")
Fixes: 94d8d6d16781 ("hw/block/nvme: support allocated namespace type")
Cc: Minwoo Im <minwoo.im.dev@gmail.com>
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
Reviewed-by: Minwoo Im <minwoo.im.dev@gmail.com>
---
 hw/block/nvme-subsys.h | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)
diff mbox series

Patch

diff --git a/hw/block/nvme-subsys.h b/hw/block/nvme-subsys.h
index 24132edd005c..1cbcad9be23e 100644
--- a/hw/block/nvme-subsys.h
+++ b/hw/block/nvme-subsys.h
@@ -49,12 +49,10 @@  static inline NvmeCtrl *nvme_subsys_ctrl(NvmeSubsystem *subsys,
 static inline NvmeNamespace *nvme_subsys_ns(NvmeSubsystem *subsys,
         uint32_t nsid)
 {
-    if (!subsys) {
+    if (!subsys || !nsid || nsid > NVME_MAX_NAMESPACES) {
         return NULL;
     }
 
-    assert(nsid && nsid <= NVME_MAX_NAMESPACES);
-
     return subsys->namespaces[nsid];
 }