From: Klaus Jensen <[email protected]> Cross-namespace copy requires the source and destination namespace to have the same logical block size. This is not verified, causing a heap out-of-bounds write.
Fix by correctly identifying the invalid operation. Cc: [email protected] Reported-by: Feng Xue and XGPT of ThreatBook Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4173 Fixes: d522aef88d42 ("hw/nvme: add cross namespace copy support") Signed-off-by: Klaus Jensen <[email protected]> --- hw/nvme/ctrl.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c index 578421c21761..b48bf599b5d6 100644 --- a/hw/nvme/ctrl.c +++ b/hw/nvme/ctrl.c @@ -3277,6 +3277,11 @@ static void nvme_do_copy(NvmeCopyAIOCB *iocb) status = NVME_INVALID_FIELD | NVME_DNR; goto invalid; } else if (snsid != dnsid) { + if (sns->lbaf.ds != dns->lbaf.ds) { + status = NVME_CMD_INCOMP_NS_OR_FMT | NVME_DNR; + goto invalid; + } + if (!NVME_ID_NS_DPS_TYPE(sns->id_ns.dps) && !NVME_ID_NS_DPS_TYPE(dns->id_ns.dps)) { if (!nvme_copy_matching_ns_format(sns, dns, false)) { --- base-commit: 8967b2fe1b2aaae3c29e207d85fab901d580a2dc change-id: 20261021-fix-4173-d188c1a2ffdf Best regards, -- Klaus Jensen <[email protected]>
