From 9932551154ff38b87e73c0ab209a1b75f702e84d Mon Sep 17 00:00:00 2001 From: Klaus Jensen Date: Mon, 6 Jul 2020 08:12:58 +0200 Subject: [PATCH] hw/block/nvme: make sure ncqr and nsqr is valid 0xffff is not an allowed value for NCQR and NSQR in Set Features on Number of Queues. Signed-off-by: Klaus Jensen Acked-by: Keith Busch Reviewed-by: Maxim Levitsky Reviewed-by: Dmitry Fomichev Message-Id: <20200706061303.246057-14-its@irrelevant.dk> --- hw/block/nvme.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/hw/block/nvme.c b/hw/block/nvme.c index bfc23037c3..a5f6dc4b8e 100644 --- a/hw/block/nvme.c +++ b/hw/block/nvme.c @@ -1310,6 +1310,14 @@ static uint16_t nvme_set_feature(NvmeCtrl *n, NvmeCmd *cmd, NvmeRequest *req) blk_set_enable_write_cache(n->conf.blk, dw11 & 1); break; case NVME_NUMBER_OF_QUEUES: + /* + * NVMe v1.3, Section 5.21.1.7: 0xffff is not an allowed value for NCQR + * and NSQR. + */ + if ((dw11 & 0xffff) == 0xffff || ((dw11 >> 16) & 0xffff) == 0xffff) { + return NVME_INVALID_FIELD | NVME_DNR; + } + trace_pci_nvme_setfeat_numq((dw11 & 0xFFFF) + 1, ((dw11 >> 16) & 0xFFFF) + 1, n->params.max_ioqpairs,