From 8d2c997da2654166c00e74f2dd0ab98b9c5630b1 Mon Sep 17 00:00:00 2001 From: Augustin Cavalier Date: Thu, 27 Apr 2023 15:12:14 -0400 Subject: [PATCH] nvme_disk: Add missing bounds check and adjust clamping. --- .../kernel/drivers/disk/nvme/nvme_disk.cpp | 20 +++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/src/add-ons/kernel/drivers/disk/nvme/nvme_disk.cpp b/src/add-ons/kernel/drivers/disk/nvme/nvme_disk.cpp index 94ebe68507..dca857e91b 100644 --- a/src/add-ons/kernel/drivers/disk/nvme/nvme_disk.cpp +++ b/src/add-ons/kernel/drivers/disk/nvme/nvme_disk.cpp @@ -624,6 +624,10 @@ nvme_disk_io(void* cookie, io_request* request) nvme_disk_handle* handle = (nvme_disk_handle*)cookie; + const off_t ns_end = (handle->info->capacity * handle->info->block_size); + if ((request->Offset() + (off_t)request->Length()) > ns_end) + return ERANGE; + nvme_io_request nvme_request; memset(&nvme_request, 0, sizeof(nvme_io_request)); @@ -797,11 +801,11 @@ nvme_disk_read(void* cookie, off_t pos, void* buffer, size_t* length) CALLED(); nvme_disk_handle* handle = (nvme_disk_handle*)cookie; - const off_t end = (handle->info->capacity * handle->info->block_size); - if (pos >= end) + const off_t ns_end = (handle->info->capacity * handle->info->block_size); + if (pos >= ns_end) return B_BAD_VALUE; - if (pos + (off_t)*length > end) - *length = end - pos; + if ((pos + (off_t)*length) > ns_end) + *length = ns_end - pos; IORequest request; status_t status = request.Init(pos, (addr_t)buffer, *length, false, 0); @@ -820,11 +824,11 @@ nvme_disk_write(void* cookie, off_t pos, const void* buffer, size_t* length) CALLED(); nvme_disk_handle* handle = (nvme_disk_handle*)cookie; - const off_t end = (handle->info->capacity * handle->info->block_size); - if (pos >= end) + const off_t ns_end = (handle->info->capacity * handle->info->block_size); + if (pos >= ns_end) return B_BAD_VALUE; - if (pos + (off_t)*length > end) - *length = end - pos; + if ((pos + (off_t)*length) > ns_end) + *length = ns_end - pos; IORequest request; status_t status = request.Init(pos, (addr_t)buffer, *length, true, 0);