37 lines
1.3 KiB
Diff
37 lines
1.3 KiB
Diff
|
From 43fdaaa492ea10ab0e90ec4cc68ec45aed1d415c Mon Sep 17 00:00:00 2001
|
||
|
|
From: gubin <gubin_yewu@cmss.chinamobile.com>
|
||
|
|
Date: Sat, 22 Mar 2025 15:20:27 +0800
|
||
|
|
Subject: [PATCH] hw/nvme: fix invalid check on mcl
|
||
|
|
|
||
|
|
cherry-pick from 8c78015a55d84c016da6d5e41b6b5f618ecb25ab
|
||
|
|
|
||
|
|
The number of logical blocks within a source range is converted into a
|
||
|
|
1s based number at the time of parsing. However, when verifying the copy
|
||
|
|
length we add one again, causing the check against MCL to fail in error.
|
||
|
|
|
||
|
|
Cc: qemu-stable@nongnu.org
|
||
|
|
Fixes: 381ab99d8587 ("hw/nvme: check maximum copy length (MCL) for COPY")
|
||
|
|
Reviewed-by: Minwoo Im <minwoo.im@samsung.com>
|
||
|
|
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
|
||
|
|
Signed-off-by: gubin <gubin_yewu@cmss.chinamobile.com>
|
||
|
|
---
|
||
|
|
hw/nvme/ctrl.c | 2 +-
|
||
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
||
|
|
|
||
|
|
diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c
|
||
|
|
index 29445938d5..407004b2f7 100644
|
||
|
|
--- a/hw/nvme/ctrl.c
|
||
|
|
+++ b/hw/nvme/ctrl.c
|
||
|
|
@@ -2863,7 +2863,7 @@ static inline uint16_t nvme_check_copy_mcl(NvmeNamespace *ns,
|
||
|
|
uint32_t nlb;
|
||
|
|
nvme_copy_source_range_parse(iocb->ranges, idx, iocb->format, NULL,
|
||
|
|
&nlb, NULL, NULL, NULL);
|
||
|
|
- copy_len += nlb + 1;
|
||
|
|
+ copy_len += nlb;
|
||
|
|
}
|
||
|
|
|
||
|
|
if (copy_len > ns->id_ns.mcl) {
|
||
|
|
--
|
||
|
|
2.41.0.windows.1
|
||
|
|
|