Commit ec20329748 for qemu.org

commit ec20329748d02728b823443436fe26eadb04f8cc
Author: Klaus Jensen <k.jensen@samsung.com>
Date:   Wed Apr 7 07:07:43 2021 +0200

    hw/block/nvme: fix assert crash in nvme_subsys_ns

    nvme_subsys_ns() is used in contexts where the namespace identifier is
    taken from an untrusted source. Commit 3921756dee6d ("hw/block/nvme:
    assert namespaces array indices") tried to guard against this by
    introducing an assert on the namespace identifier.

    This is wrong since it is perfectly valid to call the function with an
    invalid namespace identifier and like nvme_ns(), nvme_subsys_ns() should
    simply return NULL.

    Fixes: 3921756dee6d ("hw/block/nvme: assert namespaces array indices")
    Fixes: 94d8d6d16781 ("hw/block/nvme: support allocated namespace type")
    Cc: Minwoo Im <minwoo.im.dev@gmail.com>
    Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
    Reviewed-by: Minwoo Im <minwoo.im.dev@gmail.com>

diff --git a/hw/block/nvme-subsys.h b/hw/block/nvme-subsys.h
index 24132edd00..1cbcad9be2 100644
--- a/hw/block/nvme-subsys.h
+++ b/hw/block/nvme-subsys.h
@@ -49,12 +49,10 @@ static inline NvmeCtrl *nvme_subsys_ctrl(NvmeSubsystem *subsys,
 static inline NvmeNamespace *nvme_subsys_ns(NvmeSubsystem *subsys,
         uint32_t nsid)
 {
-    if (!subsys) {
+    if (!subsys || !nsid || nsid > NVME_MAX_NAMESPACES) {
         return NULL;
     }

-    assert(nsid && nsid <= NVME_MAX_NAMESPACES);
-
     return subsys->namespaces[nsid];
 }