diff options
author | Richard Henderson <richard.henderson@linaro.org> | 2021-11-19 11:01:46 +0100 |
---|---|---|
committer | Richard Henderson <richard.henderson@linaro.org> | 2021-11-19 11:01:46 +0100 |
commit | 9c25e1db18d872cbab3f028f93db37931dbc6ae2 (patch) | |
tree | ade57d02097d43ea1f5a1082fe6b2a9ebb91712a /hw | |
parent | 3760a04c352f8d255b247211f6da07ac99f1630a (diff) | |
parent | e2c57529c9306e4c9aac75d9879f6e7699584a22 (diff) | |
download | qemu-9c25e1db18d872cbab3f028f93db37931dbc6ae2.zip qemu-9c25e1db18d872cbab3f028f93db37931dbc6ae2.tar.gz qemu-9c25e1db18d872cbab3f028f93db37931dbc6ae2.tar.bz2 |
Merge tag 'nvme-fixes-for-6.2-pull-request' of git://git.infradead.org/qemu-nvme into staging
hw/nvme fixes
* Fix CVE-2021-3947
* Controller hotplugging fixes
# gpg: Signature made Fri 19 Nov 2021 08:59:03 AM CET
# gpg: using RSA key 522833AA75E2DCE6A24766C04DE1AF316D4F0DE9
# gpg: Good signature from "Klaus Jensen <its@irrelevant.dk>" [unknown]
# gpg: aka "Klaus Jensen <k.jensen@samsung.com>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: DDCA 4D9C 9EF9 31CC 3468 4272 63D5 6FC5 E55D A838
# Subkey fingerprint: 5228 33AA 75E2 DCE6 A247 66C0 4DE1 AF31 6D4F 0DE9
* tag 'nvme-fixes-for-6.2-pull-request' of git://git.infradead.org/qemu-nvme:
hw/nvme: fix buffer overrun in nvme_changed_nslist (CVE-2021-3947)
hw/nvme: change nvme-ns 'shared' default
hw/nvme: reattach subsystem namespaces on hotplug
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Diffstat (limited to 'hw')
-rw-r--r-- | hw/core/machine.c | 1 | ||||
-rw-r--r-- | hw/nvme/ctrl.c | 5 | ||||
-rw-r--r-- | hw/nvme/ns.c | 8 | ||||
-rw-r--r-- | hw/nvme/subsys.c | 10 |
4 files changed, 16 insertions, 8 deletions
diff --git a/hw/core/machine.c b/hw/core/machine.c index 26ec54e..53a99ab 100644 --- a/hw/core/machine.c +++ b/hw/core/machine.c @@ -39,6 +39,7 @@ GlobalProperty hw_compat_6_1[] = { { "vhost-user-vsock-device", "seqpacket", "off" }, + { "nvme-ns", "shared", "off" }, }; const size_t hw_compat_6_1_len = G_N_ELEMENTS(hw_compat_6_1); diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c index 6a571d1..5f573c4 100644 --- a/hw/nvme/ctrl.c +++ b/hw/nvme/ctrl.c @@ -4168,6 +4168,11 @@ static uint16_t nvme_changed_nslist(NvmeCtrl *n, uint8_t rae, uint32_t buf_len, int i = 0; uint32_t nsid; + if (off >= sizeof(nslist)) { + trace_pci_nvme_err_invalid_log_page_offset(off, sizeof(nslist)); + return NVME_INVALID_FIELD | NVME_DNR; + } + memset(nslist, 0x0, sizeof(nslist)); trans_len = MIN(sizeof(nslist) - off, buf_len); diff --git a/hw/nvme/ns.c b/hw/nvme/ns.c index b7cf149..8b5f98c 100644 --- a/hw/nvme/ns.c +++ b/hw/nvme/ns.c @@ -465,12 +465,6 @@ static void nvme_ns_realize(DeviceState *dev, Error **errp) "linked to an nvme-subsys device"); return; } - - if (ns->params.shared) { - error_setg(errp, "shared requires that the nvme device is " - "linked to an nvme-subsys device"); - return; - } } else { /* * If this namespace belongs to a subsystem (through a link on the @@ -532,7 +526,7 @@ static void nvme_ns_realize(DeviceState *dev, Error **errp) static Property nvme_ns_props[] = { DEFINE_BLOCK_PROPERTIES(NvmeNamespace, blkconf), DEFINE_PROP_BOOL("detached", NvmeNamespace, params.detached, false), - DEFINE_PROP_BOOL("shared", NvmeNamespace, params.shared, false), + DEFINE_PROP_BOOL("shared", NvmeNamespace, params.shared, true), DEFINE_PROP_UINT32("nsid", NvmeNamespace, params.nsid, 0), DEFINE_PROP_UUID("uuid", NvmeNamespace, params.uuid), DEFINE_PROP_UINT64("eui64", NvmeNamespace, params.eui64, 0), diff --git a/hw/nvme/subsys.c b/hw/nvme/subsys.c index 495dcff..fb58d63 100644 --- a/hw/nvme/subsys.c +++ b/hw/nvme/subsys.c @@ -14,7 +14,7 @@ int nvme_subsys_register_ctrl(NvmeCtrl *n, Error **errp) { NvmeSubsystem *subsys = n->subsys; - int cntlid; + int cntlid, nsid; for (cntlid = 0; cntlid < ARRAY_SIZE(subsys->ctrls); cntlid++) { if (!subsys->ctrls[cntlid]) { @@ -29,12 +29,20 @@ int nvme_subsys_register_ctrl(NvmeCtrl *n, Error **errp) subsys->ctrls[cntlid] = n; + for (nsid = 1; nsid < ARRAY_SIZE(subsys->namespaces); nsid++) { + NvmeNamespace *ns = subsys->namespaces[nsid]; + if (ns && ns->params.shared && !ns->params.detached) { + nvme_attach_ns(n, ns); + } + } + return cntlid; } void nvme_subsys_unregister_ctrl(NvmeSubsystem *subsys, NvmeCtrl *n) { subsys->ctrls[n->cntlid] = NULL; + n->cntlid = -1; } static void nvme_subsys_setup(NvmeSubsystem *subsys) |