HomeFreeBSD

bhyve nvme: Fix out-of-bound IOV array access

Description

bhyve nvme: Fix out-of-bound IOV array access

Summary:
NVMe operations indicate the memory region(s) associated with a command
via physical region pages (PRPs). Since each PRP has a fixed size,
contiguous memory regions larger than the PRP size require multiple PRP
entries.

Instead of issuing a blockif call for each PRP, the NVMe emulation
concatenates multiple contiguous PRP entries into a single blockif
request. The test for contiguous regions has a bug such that it
mistakenly treats an initial PRP address of zero as a contiguous range
and concatenates it with the previous. But because there is no previous
IOV, the concatenation code corrupts the IO request structure and leads
to a segmentation fault when the blockif request completes.

Fix is to test for the existence of a previous range before trying to
concatenate the current range with the previous one.

While in the area, rename pci_nvme_append_iov_req()'s lba parameter to
offset to match its usage.

PR: 264177

(cherry picked from commit 88951aaaee73b87121b0f121224fe188a5b5e6e3)

Details

Provenance
chuckAuthored on Jun 9 2022, 6:19 PM
Parents
rGd878a66a9a77: wait for device mounts in zpool and dumpon
Branches
Unknown
Tags
Unknown