mirrors/qemu
0
0
Fork 0
mirror of https://github.com/qemu/qemu.git synced 2024-12-14 15:03:33 +08:00
Code Issues Packages Projects Releases Wiki Activity

hw/nvme: check maximum copy length (MCL) for COPY

Browse Source 
MCL(Maximum Copy Length) in the Identify Namespace data structure limits
the number of LBAs to be copied inside of the controller.  We've not
checked it at all, so added the check with returning the proper error
status.

Signed-off-by: Minwoo Im <minwoo.im@samsung.com>
Reviewed-by: Klaus Jensen <k.jensen@samsung.com>
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
This commit is contained in:
Minwoo Im 2023-04-18 09:26:22 +09:00 committed by Klaus Jensen
parent cab1da59c2
commit 381ab99d85
1 changed files with 24 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
hw/nvme/ctrl.c
View File

@ -2855,6 +2855,25 @@ static void nvme_copy_source_range_parse(void *ranges, int idx, uint8_t format,
}
}
static inline uint16_t nvme_check_copy_mcl(NvmeNamespace *ns,
NvmeCopyAIOCB *iocb, uint16_t nr)
{
uint32_t copy_len = 0;
for (int idx = 0; idx < nr; idx++) {
uint32_t nlb;
nvme_copy_source_range_parse(iocb->ranges, idx, iocb->format, NULL,
&nlb, NULL, NULL, NULL);
copy_len += nlb + 1;
}
if (copy_len > ns->id_ns.mcl) {
return NVME_CMD_SIZE_LIMIT | NVME_DNR;
}
return NVME_SUCCESS;
}
static void nvme_copy_out_completed_cb(void *opaque, int ret)
{
NvmeCopyAIOCB *iocb = opaque;
@ -3167,6 +3186,11 @@ static uint16_t nvme_copy(NvmeCtrl *n, NvmeRequest *req)
}
}
status = nvme_check_copy_mcl(ns, iocb, nr);
if (status) {
goto invalid;
}
iocb->req = req;
iocb->ret = 0;
iocb->nr = nr;