[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Stable-8.1.3 38/55] block/nvme: nvme_process_completion() fix bound for
From: |
Michael Tokarev |
Subject: |
[Stable-8.1.3 38/55] block/nvme: nvme_process_completion() fix bound for cid |
Date: |
Thu, 9 Nov 2023 16:42:42 +0300 |
From: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
NVMeQueuePair::reqs has length NVME_NUM_REQS, which less than
NVME_QUEUE_SIZE by 1.
Fixes: 1086e95da17050 ("block/nvme: switch to a NVMeRequest freelist")
Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Maksim Davydov <davydov-max@yandex-team.ru>
Message-id: 20231017125941.810461-5-vsementsov@yandex-team.ru
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
(cherry picked from commit cc8fb0c3ae3c950eb40e969607e17ff16a7519ac)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
diff --git a/block/nvme.c b/block/nvme.c
index b6e95f0b7e..0faedf3072 100644
--- a/block/nvme.c
+++ b/block/nvme.c
@@ -416,9 +416,10 @@ static bool nvme_process_completion(NVMeQueuePair *q)
q->cq_phase = !q->cq_phase;
}
cid = le16_to_cpu(c->cid);
- if (cid == 0 || cid > NVME_QUEUE_SIZE) {
- warn_report("NVMe: Unexpected CID in completion queue: %"PRIu32", "
- "queue size: %u", cid, NVME_QUEUE_SIZE);
+ if (cid == 0 || cid > NVME_NUM_REQS) {
+ warn_report("NVMe: Unexpected CID in completion queue: %" PRIu32
+ ", should be within: 1..%u inclusively", cid,
+ NVME_NUM_REQS);
continue;
}
trace_nvme_complete_command(s, q->index, cid);
--
2.39.2
- [Stable-8.1.3 29/55] util/uuid: Remove UUID_FMT_LEN, (continued)
- [Stable-8.1.3 29/55] util/uuid: Remove UUID_FMT_LEN, Michael Tokarev, 2023/11/09
- [Stable-8.1.3 30/55] i386/xen: Don't advertise XENFEAT_supervisor_mode_kernel, Michael Tokarev, 2023/11/09
- [Stable-8.1.3 35/55] hw/xen: take iothread mutex in xen_evtchn_reset_op(), Michael Tokarev, 2023/11/09
- [Stable-8.1.3 32/55] hw/xen: select kernel mode for per-vCPU event channel upcall vector, Michael Tokarev, 2023/11/09
- [Stable-8.1.3 31/55] i386/xen: fix per-vCPU upcall vector for Xen emulation, Michael Tokarev, 2023/11/09
- [Stable-8.1.3 33/55] hw/xen: don't clear map_track[] in xen_gnttab_reset(), Michael Tokarev, 2023/11/09
- [Stable-8.1.3 34/55] hw/xen: fix XenStore watch delivery to guest, Michael Tokarev, 2023/11/09
- [Stable-8.1.3 39/55] target/arm: Fix A64 LDRA immediate decode, Michael Tokarev, 2023/11/09
- [Stable-8.1.3 36/55] hw/xen: use correct default protocol for xen-block on x86, Michael Tokarev, 2023/11/09
- [Stable-8.1.3 37/55] virtio-gpu: block migration of VMs with blob=true, Michael Tokarev, 2023/11/09
- [Stable-8.1.3 38/55] block/nvme: nvme_process_completion() fix bound for cid,
Michael Tokarev <=
- [Stable-8.1.3 41/55] block/file-posix: fix update_zones_wp() caller, Michael Tokarev, 2023/11/09
- [Stable-8.1.3 45/55] ui/gtk-egl: apply scale factor when calculating window's dimension, Michael Tokarev, 2023/11/09
- [Stable-8.1.3 40/55] qcow2: keep reference on zeroize with discard-no-unref enabled, Michael Tokarev, 2023/11/09
- [Stable-8.1.3 42/55] file-posix: fix over-writing of returning zone_append offset, Michael Tokarev, 2023/11/09
- [Stable-8.1.3 43/55] ati-vga: Implement fallback for pixman routines, Michael Tokarev, 2023/11/09
- [Stable-8.1.3 44/55] ui/gtk: force realization of drawing area, Michael Tokarev, 2023/11/09
- [Stable-8.1.3 46/55] ui/gtk-egl: Check EGLSurface before doing scanout, Michael Tokarev, 2023/11/09
- [Stable-8.1.3 47/55] target/mips: Fix MSA BZ/BNZ opcodes displacement, Michael Tokarev, 2023/11/09
- [Stable-8.1.3 48/55] target/mips: Fix TX79 LQ/SQ opcodes, Michael Tokarev, 2023/11/09
- [Stable-8.1.3 49/55] hw/ide: reset: cancel async DMA operation before resetting state, Michael Tokarev, 2023/11/09