[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL for-6.2 3/3] hw/nvme: fix buffer overrun in nvme_changed_nslist (C
|
From: |
Klaus Jensen |
|
Subject: |
[PULL for-6.2 3/3] hw/nvme: fix buffer overrun in nvme_changed_nslist (CVE-2021-3947) |
|
Date: |
Fri, 19 Nov 2021 09:09:54 +0100 |
From: Klaus Jensen <k.jensen@samsung.com>
Fix missing offset verification.
Cc: qemu-stable@nongnu.org
Cc: Philippe Mathieu-Daudé <philmd@redhat.com>
Reported-by: Qiuhao Li <Qiuhao.Li@outlook.com>
Fixes: f432fdfa121 ("support changed namespace asynchronous event")
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
---
hw/nvme/ctrl.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c
index 6a571d18cfae..5f573c417b3d 100644
--- a/hw/nvme/ctrl.c
+++ b/hw/nvme/ctrl.c
@@ -4168,6 +4168,11 @@ static uint16_t nvme_changed_nslist(NvmeCtrl *n, uint8_t
rae, uint32_t buf_len,
int i = 0;
uint32_t nsid;
+ if (off >= sizeof(nslist)) {
+ trace_pci_nvme_err_invalid_log_page_offset(off, sizeof(nslist));
+ return NVME_INVALID_FIELD | NVME_DNR;
+ }
+
memset(nslist, 0x0, sizeof(nslist));
trans_len = MIN(sizeof(nslist) - off, buf_len);
--
2.34.0