i2p/haiku-beta6
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

nvme_disk: Add missing bounds check and adjust clamping.

Browse Source
This commit is contained in:
Augustin Cavalier
2023-04-27 15:12:14 -04:00
parent fc12af740f
commit 8d2c997da2
1 changed files with 12 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/add-ons/kernel/drivers/disk/nvme/nvme_disk.cpp
+12 -8
View File
@@ -624,6 +624,10 @@ nvme_disk_io(void* cookie, io_request* request)
nvme_disk_handle* handle = (nvme_disk_handle*)cookie; nvme_disk_handle* handle = (nvme_disk_handle*)cookie;
const off_t ns_end = (handle->info->capacity * handle->info->block_size);
if ((request->Offset() + (off_t)request->Length()) > ns_end)
return ERANGE;
nvme_io_request nvme_request; nvme_io_request nvme_request;
memset(&nvme_request, 0, sizeof(nvme_io_request)); memset(&nvme_request, 0, sizeof(nvme_io_request));
@@ -797,11 +801,11 @@ nvme_disk_read(void* cookie, off_t pos, void* buffer, size_t* length)
CALLED(); CALLED();
nvme_disk_handle* handle = (nvme_disk_handle*)cookie; nvme_disk_handle* handle = (nvme_disk_handle*)cookie;
const off_t end = (handle->info->capacity * handle->info->block_size); const off_t ns_end = (handle->info->capacity * handle->info->block_size);
if (pos >= end) if (pos >= ns_end)
return B_BAD_VALUE; return B_BAD_VALUE;
if (pos + (off_t)*length > end) if ((pos + (off_t)*length) > ns_end)
*length = end - pos; *length = ns_end - pos;
IORequest request; IORequest request;
status_t status = request.Init(pos, (addr_t)buffer, *length, false, 0); status_t status = request.Init(pos, (addr_t)buffer, *length, false, 0);
@@ -820,11 +824,11 @@ nvme_disk_write(void* cookie, off_t pos, const void* buffer, size_t* length)
CALLED(); CALLED();
nvme_disk_handle* handle = (nvme_disk_handle*)cookie; nvme_disk_handle* handle = (nvme_disk_handle*)cookie;
const off_t end = (handle->info->capacity * handle->info->block_size); const off_t ns_end = (handle->info->capacity * handle->info->block_size);
if (pos >= end) if (pos >= ns_end)
return B_BAD_VALUE; return B_BAD_VALUE;
if (pos + (off_t)*length > end) if ((pos + (off_t)*length) > ns_end)
*length = end - pos; *length = ns_end - pos;
IORequest request; IORequest request;
status_t status = request.Init(pos, (addr_t)buffer, *length, true, 0); status_t status = request.Init(pos, (addr_t)buffer, *length, true, 0);