nvme: bound the AER error log byte-swap by the fetched length
ClosedPublic
Actions

Authored by seuros on Sun, Sep 13, 8:46 AM.

Details

Reviewers

imp
adrian
ngie

Commits

rG34f131f1de85: nvme: bound the AER error log byte-swap by the fetched length

Summary

The Get Log Page request for the error log is clamped to
NVME_MAX_AER_LOG_SIZE, but the byte-swap loop iterated ELPE + 1
entries. A controller reporting more than 63 entries makes the loop
overrun the 4 KiB log page buffer.

Diff Detail

Repository

rG FreeBSD src repository

Lint

Lint Not Applicable

Unit

Tests Not Applicable

Event Timeline

seuros created this revision.Sun, Sep 13, 8:46 AM

Herald added a subscriber: dab. · View Herald TranscriptSun, Sep 13, 8:46 AM

seuros requested review of this revision.Sun, Sep 13, 8:46 AM

Harbormaster completed remote builds in B76816: Diff 186561.Sun, Sep 13, 8:46 AM

seuros added a project: drivers.Sun, Sep 13, 10:03 AM

seuros added a parent revision: D59625: nvme: reject namespaces formatted with metadata.

seuros added a child revision: D59627: nvme: honor FLBAS Format Index Upper when selecting the LBA format.

ngie accepted this revision.Tue, Sep 22, 3:40 AM

This revision is now accepted and ready to land.Tue, Sep 22, 3:40 AM

imp accepted this revision.Tue, Sep 22, 5:02 AM

imp added inline comments.

sys/dev/nvme/nvme_ctrlr.c
1294	While this is right, we shouldn't be byte swapping the error log at all... there's too many formats and we can't know them all. It was a mistake to do this (one I tried to raise at the time, iirc, but there was so much else going on with the big endian patches)