Project

General

Profile

Actions
Copy link

Bug #6466

closed

off-by-one in nvme_get_logpage()

Added by Hans Rosenfeld almost 7 years ago. Updated almost 7 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Hans Rosenfeld
Category:
driver - device drivers
Start date:
2015-11-19
Due date:
% Done:

100%

Estimated time:
Difficulty:
Bite-size
Tags:
needs-triage
Gerrit CR:
External Bug:

Description

The buffer size field in the GET LOGPAGE command is 0-based, so the driver needs to substract 1 from the calculated buffer size before passing this to the hardware.

This was found on a Samsung SSD, which detected the wrong buffer size and returned an error, which in turn was correctly identified as a programming error in nvme and led to a panic.

Actions
Copy link
 #1

Updated by Electric Monk almost 7 years ago

  • Status changed from New to Closed
  • % Done changed from 0 to 100

git commit 9898bbdb3aee66342820dd5570925a6ad4783d08

commit  9898bbdb3aee66342820dd5570925a6ad4783d08
Author: Hans Rosenfeld <hans.rosenfeld@nexenta.com>
Date:   2015-11-19T22:50:35.000Z

    6466 off-by-one in nvme_get_logpage()
    Reviewed by: Dan McDonald <danmcd@omniti.com>
    Reviewed by: Toomas Soome <tsoome@me.com>
    Reviewed by: Garrett D'Amore <garrett@damore.org>
    Approved by: Robert Mustacchi <rm@joyent.com>

Actions
Copy link

Also available in: Atom PDF