mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

hw/block/nvme: fix ref counting in nvme_format_ns

Browse Source 
Max noticed that since blk_aio_pwrite_zeroes() may invoke the callback
before returning, the callbacks will never see *count == 0 and thus
never free the count variable or decrement num_formats causing a CQE to
never be posted.

Coverity (CID 1451082) also picked up on the fact that count would not
be free'ed if the namespace was of zero size.

Fix both of these issues by explicitly checking *count and finalize for
the given namespace if --(*count) is zero. Enqueing a CQE if there are
no AIOs outstanding after this case is already handled by nvme_format()
by inspecting *num_formats.

Reported-by: Max Reitz <mreitz@redhat.com>
Reported-by: Coverity (CID 1451082)
Fixes: dc04d25e2f ("hw/block/nvme: add support for the format nvm command")
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
Reviewed-by: Gollu Appalanaidu <anaidu.gollu@samsung.com>
This commit is contained in:
Klaus Jensen 2021-03-22 07:10:24 +01:00
parent 9561353ddc
commit 3a69cadbef
1 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
hw/block/nvme.c
View File

@ -5009,9 +5009,15 @@ static uint16_t nvme_format_ns(NvmeCtrl *n, NvmeNamespace *ns, uint8_t lbaf,
}
(*count)--;
if (--(*count)) {
return NVME_NO_COMPLETE;
}
return NVME_NO_COMPLETE;
g_free(count);
ns->status = 0x0;
(*num_formats)--;
return NVME_SUCCESS;
}
static uint16_t nvme_format(NvmeCtrl *n, NvmeRequest *req)