From: Klaus Jensen <k.jensen@samsung.com>
Date: Thu, 8 Feb 2024 12:22:48 +0000 (+0100)
Subject: hw/nvme: fix invalid check on mcl
X-Git-Url: http://git.maquefel.me/?a=commitdiff_plain;h=8c78015a55d84c016da6d5e41b6b5f618ecb25ab;p=qemu.git

hw/nvme: fix invalid check on mcl

The number of logical blocks within a source range is converted into a
1s based number at the time of parsing. However, when verifying the copy
length we add one again, causing the check against MCL to fail in error.

Cc: qemu-stable@nongnu.org
Fixes: 381ab99d8587 ("hw/nvme: check maximum copy length (MCL) for COPY")
Reviewed-by: Minwoo Im <minwoo.im@samsung.com>
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
---

diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c
index 94ef639457..abc0387f2c 100644
--- a/hw/nvme/ctrl.c
+++ b/hw/nvme/ctrl.c
@@ -2855,7 +2855,7 @@ static inline uint16_t nvme_check_copy_mcl(NvmeNamespace *ns,
         uint32_t nlb;
         nvme_copy_source_range_parse(iocb->ranges, idx, iocb->format, NULL,
                                      &nlb, NULL, NULL, NULL);
-        copy_len += nlb + 1;
+        copy_len += nlb;
     }
 
     if (copy_len > ns->id_ns.mcl) {