Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 608cc4b1 authored by Christoph Hellwig's avatar Christoph Hellwig
Browse files

nvme: fix lightnvm check 



nvme_nvm_ns_supported assumes every device is a pci_dev, which leads to
reading an incorrect field, or possible even a dereference of unallocated
memory for fabrics controllers.

Fix this by introducing a quirk for lighnvm capable devices instead.

Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
Reviewed-by: default avatarMatias Bjørling <mb@lightnvm.io>
Reviewed-by: default avatarKeith Busch <keith.busch@intel.com>
Reviewed-by: default avatarSagi Grimberg <sagi@grimberg.me>
parent 09c2c359

drivers/nvme/host/core.c

+5 −4
Original line number Diff line number Diff line
@@ -2377,11 +2377,12 @@ static void nvme_alloc_ns(struct nvme_ctrl *ctrl, unsigned nsid) 


	nvme_report_ns_ids(ctrl, ns->ns_id, id, ns->eui, ns->nguid, &ns->uuid);



	if (nvme_nvm_ns_supported(ns, id) &&

				nvme_nvm_register(ns, disk_name, node)) {

		dev_warn(ctrl->device, "%s: LightNVM init failure\n", __func__);

	if ((ctrl->quirks & NVME_QUIRK_LIGHTNVM) && id->vs[0] == 0x1) {

		if (nvme_nvm_register(ns, disk_name, node)) {

			dev_warn(ctrl->device, "LightNVM init failure\n");

			goto out_free_id;

		}

	}



	disk = alloc_disk_node(0, node);

	if (!disk)

drivers/nvme/host/lightnvm.c

+0 −26
Original line number Diff line number Diff line
@@ -955,29 +955,3 @@ void nvme_nvm_unregister_sysfs(struct nvme_ns *ns) 
	sysfs_remove_group(&disk_to_dev(ns->disk)->kobj,

					&nvm_dev_attr_group);

}
 


/* move to shared place when used in multiple places. */

#define PCI_VENDOR_ID_CNEX 0x1d1d

#define PCI_DEVICE_ID_CNEX_WL 0x2807

#define PCI_DEVICE_ID_CNEX_QEMU 0x1f1f



int nvme_nvm_ns_supported(struct nvme_ns *ns, struct nvme_id_ns *id)

{

	struct nvme_ctrl *ctrl = ns->ctrl;

	/* XXX: this is poking into PCI structures from generic code! */

	struct pci_dev *pdev = to_pci_dev(ctrl->dev);



	/* QEMU NVMe simulator - PCI ID + Vendor specific bit */

	if (pdev->vendor == PCI_VENDOR_ID_CNEX &&

				pdev->device == PCI_DEVICE_ID_CNEX_QEMU &&

							id->vs[0] == 0x1)

		return 1;



	/* CNEX Labs - PCI ID + Vendor specific bit */

	if (pdev->vendor == PCI_VENDOR_ID_CNEX &&

				pdev->device == PCI_DEVICE_ID_CNEX_WL &&

							id->vs[0] == 0x1)

		return 1;



	return 0;

}

drivers/nvme/host/nvme.h

+5 −5
Original line number Diff line number Diff line
@@ -75,6 +75,11 @@ enum nvme_quirks { 
	 * The deepest sleep state should not be used.

	 */

	NVME_QUIRK_NO_DEEPEST_PS		= (1 << 5),



	/*

	 * Supports the LighNVM command set if indicated in vs[1].

	 */

	NVME_QUIRK_LIGHTNVM			= (1 << 6),

};



/*
@@ -320,7 +325,6 @@ void nvme_stop_keep_alive(struct nvme_ctrl *ctrl); 
int nvme_reset_ctrl(struct nvme_ctrl *ctrl);



#ifdef CONFIG_NVM

int nvme_nvm_ns_supported(struct nvme_ns *ns, struct nvme_id_ns *id);

int nvme_nvm_register(struct nvme_ns *ns, char *disk_name, int node);

void nvme_nvm_unregister(struct nvme_ns *ns);

int nvme_nvm_register_sysfs(struct nvme_ns *ns);
@@ -339,10 +343,6 @@ static inline int nvme_nvm_register_sysfs(struct nvme_ns *ns) 
	return 0;

}

static inline void nvme_nvm_unregister_sysfs(struct nvme_ns *ns) {};

static inline int nvme_nvm_ns_supported(struct nvme_ns *ns, struct nvme_id_ns *id)

{

	return 0;

}

static inline int nvme_nvm_ioctl(struct nvme_ns *ns, unsigned int cmd,

							unsigned long arg)

{

drivers/nvme/host/pci.c

+4 −0
Original line number Diff line number Diff line
@@ -2497,6 +2497,10 @@ static const struct pci_device_id nvme_id_table[] = { 
		.driver_data = NVME_QUIRK_DELAY_BEFORE_CHK_RDY, },

	{ PCI_DEVICE(0x144d, 0xa822),   /* Samsung PM1725a */

		.driver_data = NVME_QUIRK_DELAY_BEFORE_CHK_RDY, },

	{ PCI_DEVICE(0x1d1d, 0x1f1f),	/* LighNVM qemu device */

		.driver_data = NVME_QUIRK_LIGHTNVM, },

	{ PCI_DEVICE(0x1d1d, 0x2807),	/* CNEX WL */

		.driver_data = NVME_QUIRK_LIGHTNVM, },

	{ PCI_DEVICE_CLASS(PCI_CLASS_STORAGE_EXPRESS, 0xffffff) },

	{ PCI_DEVICE(PCI_VENDOR_ID_APPLE, 0x2001) },

	{ PCI_DEVICE(PCI_VENDOR_ID_APPLE, 0x2003) },