diff options
| author | jimharris <jimharris@FreeBSD.org> | 2013-06-26 23:32:45 +0000 |
|---|---|---|
| committer | jimharris <jimharris@FreeBSD.org> | 2013-06-26 23:32:45 +0000 |
| commit | cd28dd275bc9135d64078d916158ede6edf72de1 (patch) | |
| tree | 1c8fcb73c6ba81f36815581b3b6eac86725a3662 /sys/dev/nvme/nvme_qpair.c | |
| parent | 8579bd1923c5d6c8b60bfa330095859b28a60ac3 (diff) | |
| download | FreeBSD-src-cd28dd275bc9135d64078d916158ede6edf72de1.zip FreeBSD-src-cd28dd275bc9135d64078d916158ede6edf72de1.tar.gz | |
Fail any passthrough command whose transfer size exceeds the controller's
max transfer size. This guards against rogue commands coming in from
userspace.
Also add KASSERTS for the virtual address and unmapped bio cases, if the
transfer size exceeds the controller's max transfer size.
Sponsored by: Intel
MFC after: 3 days
Diffstat (limited to 'sys/dev/nvme/nvme_qpair.c')
| -rw-r--r-- | sys/dev/nvme/nvme_qpair.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/sys/dev/nvme/nvme_qpair.c b/sys/dev/nvme/nvme_qpair.c index 53e5c1e..3937718 100644 --- a/sys/dev/nvme/nvme_qpair.c +++ b/sys/dev/nvme/nvme_qpair.c @@ -786,6 +786,9 @@ _nvme_qpair_submit_request(struct nvme_qpair *qpair, struct nvme_request *req) switch (req->type) { case NVME_REQUEST_VADDR: + KASSERT(req->payload_size <= qpair->ctrlr->max_xfer_size, + ("payload_size (%d) exceeds max_xfer_size (%d)\n", + req->payload_size, qpair->ctrlr->max_xfer_size)); err = bus_dmamap_load(tr->qpair->dma_tag, tr->payload_dma_map, req->u.payload, req->payload_size, nvme_payload_map, tr, 0); if (err != 0) @@ -805,6 +808,10 @@ _nvme_qpair_submit_request(struct nvme_qpair *qpair, struct nvme_request *req) break; #ifdef NVME_UNMAPPED_BIO_SUPPORT case NVME_REQUEST_BIO: + KASSERT(req->u.bio->bio_bcount <= qpair->ctrlr->max_xfer_size, + ("bio->bio_bcount (%jd) exceeds max_xfer_size (%d)\n", + (intmax_t)req->u.bio->bio_bcount, + qpair->ctrlr->max_xfer_size)); err = bus_dmamap_load_bio(tr->qpair->dma_tag, tr->payload_dma_map, req->u.bio, nvme_payload_map, tr, 0); if (err != 0) |
