From 38a58e7ce38cf73f25e5242f5f1abcfcbd250a6d Mon Sep 17 00:00:00 2001 From: Klaus Jensen Date: Mon, 6 Jul 2020 08:13:00 +0200 Subject: [PATCH] hw/block/nvme: reject invalid nsid values in active namespace id list MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit Reject the nsid broadcast value (0xffffffff) and 0xfffffffe in the Active Namespace ID list. Signed-off-by: Klaus Jensen Reviewed-by: Philippe Mathieu-Daudé Reviewed-by: Dmitry Fomichev Reviewed-by: Maxim Levitsky Message-Id: <20200706061303.246057-16-its@irrelevant.dk> --- hw/block/nvme.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/hw/block/nvme.c b/hw/block/nvme.c index 35103dac899..d884ac14a75 100644 --- a/hw/block/nvme.c +++ b/hw/block/nvme.c @@ -1007,6 +1007,16 @@ static uint16_t nvme_identify_nslist(NvmeCtrl *n, NvmeIdentify *c) trace_pci_nvme_identify_nslist(min_nsid); + /* + * Both 0xffffffff (NVME_NSID_BROADCAST) and 0xfffffffe are invalid values + * since the Active Namespace ID List should return namespaces with ids + * *higher* than the NSID specified in the command. This is also specified + * in the spec (NVM Express v1.3d, Section 5.15.4). + */ + if (min_nsid >= NVME_NSID_BROADCAST - 1) { + return NVME_INVALID_NSID | NVME_DNR; + } + list = g_malloc0(data_len); for (i = 0; i < n->num_namespaces; i++) { if (i < min_nsid) { -- 2.39.5