Page MenuHomeFreeBSD

nvme: bound the AER error log byte-swap by the fetched length
Needs ReviewPublic

Authored by seuros on Sun, Sep 13, 8:46 AM.
Referenced Files
F171780425: D59626.id186561.diff
Sun, Sep 13, 11:51 AM
F171780120: D59626.diff
Sun, Sep 13, 11:48 AM
F171766427: D59626.id186561.diff
Sun, Sep 13, 9:14 AM
F171766367: D59626.diff
Sun, Sep 13, 9:13 AM
Subscribers

Details

Reviewers
imp
adrian
ngie
Summary

The Get Log Page request for the error log is clamped to
NVME_MAX_AER_LOG_SIZE, but the byte-swap loop iterated ELPE + 1
entries. A controller reporting more than 63 entries makes the loop
overrun the 4 KiB log page buffer.

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Passed
Unit
No Test Coverage
Build Status
Buildable 76816
Build 73699: arc lint + arc unit