From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=134.134.136.65; helo=mga03.intel.com; envelope-from=hao.a.wu@intel.com; receiver=edk2-devel@lists.01.org Received: from mga03.intel.com (mga03.intel.com [134.134.136.65]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id 9E2F92117AE61 for ; Tue, 23 Oct 2018 18:19:58 -0700 (PDT) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga005.jf.intel.com ([10.7.209.41]) by orsmga103.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 23 Oct 2018 18:19:58 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.54,418,1534834800"; d="scan'208";a="268249860" Received: from shwdeopenpsi014.ccr.corp.intel.com ([10.239.9.9]) by orsmga005.jf.intel.com with ESMTP; 23 Oct 2018 18:19:57 -0700 From: Hao Wu To: edk2-devel@lists.01.org Cc: Hao Wu , Liangcheng Tang , Star Zeng Date: Wed, 24 Oct 2018 09:19:50 +0800 Message-Id: <20181024011952.20404-2-hao.a.wu@intel.com> X-Mailer: git-send-email 2.12.0.windows.1 In-Reply-To: <20181024011952.20404-1-hao.a.wu@intel.com> References: <20181024011952.20404-1-hao.a.wu@intel.com> Subject: [PATCH v2 1/3] MdeModulePkg/NvmExpressDxe: Refine data buffer & len check in PassThru X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Oct 2018 01:19:58 -0000 REF:https://bugzilla.tianocore.org/show_bug.cgi?id=1142 According to the the NVM Express spec Revision 1.1, for some commands (like Get/Set Feature Command, Figure 89 & 90 of the spec), the Memory Buffer maybe optional although the command opcode indicates there is a data transfer between host & controller (Get/Set Feature Command, Figure 38 of the spec). Hence, this commit refine the checks for the 'TransferLength' and 'TransferBuffer' field of the EFI_NVM_EXPRESS_PASS_THRU_COMMAND_PACKET structure to address this issue. Cc: Liangcheng Tang Cc: Star Zeng Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Hao Wu Reviewed-by: Ruiyu Ni --- MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressPassthru.c | 33 +++++++++++--------- 1 file changed, 18 insertions(+), 15 deletions(-) diff --git a/MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressPassthru.c b/MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressPassthru.c index 2468871322..bfcd349794 100644 --- a/MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressPassthru.c +++ b/MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressPassthru.c @@ -595,7 +595,8 @@ NvmExpressPassThru ( // if (((Sq->Opc & (BIT0 | BIT1)) != 0) && !((Packet->QueueType == NVME_ADMIN_QUEUE) && ((Sq->Opc == NVME_ADMIN_CRIOCQ_CMD) || (Sq->Opc == NVME_ADMIN_CRIOSQ_CMD)))) { - if ((Packet->TransferLength == 0) || (Packet->TransferBuffer == NULL)) { + if (((Packet->TransferLength != 0) && (Packet->TransferBuffer == NULL)) || + ((Packet->TransferLength == 0) && (Packet->TransferBuffer != NULL))) { return EFI_INVALID_PARAMETER; } @@ -605,21 +606,23 @@ NvmExpressPassThru ( Flag = EfiPciIoOperationBusMasterWrite; } - MapLength = Packet->TransferLength; - Status = PciIo->Map ( - PciIo, - Flag, - Packet->TransferBuffer, - &MapLength, - &PhyAddr, - &MapData - ); - if (EFI_ERROR (Status) || (Packet->TransferLength != MapLength)) { - return EFI_OUT_OF_RESOURCES; - } + if ((Packet->TransferLength != 0) && (Packet->TransferBuffer != NULL)) { + MapLength = Packet->TransferLength; + Status = PciIo->Map ( + PciIo, + Flag, + Packet->TransferBuffer, + &MapLength, + &PhyAddr, + &MapData + ); + if (EFI_ERROR (Status) || (Packet->TransferLength != MapLength)) { + return EFI_OUT_OF_RESOURCES; + } - Sq->Prp[0] = PhyAddr; - Sq->Prp[1] = 0; + Sq->Prp[0] = PhyAddr; + Sq->Prp[1] = 0; + } if((Packet->MetadataLength != 0) && (Packet->MetadataBuffer != NULL)) { MapLength = Packet->MetadataLength; -- 2.12.0.windows.1