On 2026-10-21T15:37:46+02:00, Klaus Jensen <[email protected]> wrote: > From: Klaus Jensen <[email protected]> > > Cross-namespace copy requires the source and destination namespace to > have the same logical block size. This is not verified, causing a heap > out-of-bounds write. > > Fix by correctly identifying the invalid operation. > > Cc: [email protected] > Reported-by: Feng Xue and XGPT of ThreatBook > Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4173 > Fixes: d522aef88d42 ("hw/nvme: add cross namespace copy support") > Signed-off-by: Klaus Jensen <[email protected]> > --- > hw/nvme/ctrl.c | 5 +++++ > 1 file changed, 5 insertions(+) > > diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c > index 578421c21761..b48bf599b5d6 100644 > --- a/hw/nvme/ctrl.c > +++ b/hw/nvme/ctrl.c > @@ -3277,6 +3277,11 @@ static void nvme_do_copy(NvmeCopyAIOCB *iocb) > status = NVME_INVALID_FIELD | NVME_DNR; > goto invalid; > } else if (snsid != dnsid) { > + if (sns->lbaf.ds != dns->lbaf.ds) { > + status = NVME_CMD_INCOMP_NS_OR_FMT | NVME_DNR; > + goto invalid; > + } > + > if (!NVME_ID_NS_DPS_TYPE(sns->id_ns.dps) && > !NVME_ID_NS_DPS_TYPE(dns->id_ns.dps)) { > if (!nvme_copy_matching_ns_format(sns, dns, false)) { > > --- > base-commit: 8967b2fe1b2aaae3c29e207d85fab901d580a2dc > change-id: 20261021-fix-4173-d188c1a2ffdf > > Best regards, > -- > Klaus Jensen <[email protected]> > > > Reviewed-by: Jesper Wendel Devantier <[email protected]>
