Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

unsoundness in nvme_configure_admin_queue(&mut self) #406

Open
lwz23 opened this issue Jan 2, 2025 · 1 comment
Open

unsoundness in nvme_configure_admin_queue(&mut self) #406

lwz23 opened this issue Jan 2, 2025 · 1 comment

Comments

@lwz23
Copy link

lwz23 commented Jan 2, 2025

Hello, thank you for your contribution in this project, I am scanning the unsoundness problem in rust project.
I notice the following code:

pub fn nvme_configure_admin_queue(&mut self) {
        let mut admin_queue = self.admin_queue.lock();

        let bar = self.bar;
        let dbs = bar + NVME_REG_DBS;

        let sq_dma_pa = admin_queue.sq_pa as u32;
        let cq_dma_pa = admin_queue.cq_pa as u32;
        let data_dma_pa = admin_queue.data_pa as u64;

        let aqa_low_16 = 31_u16;
        let aqa_high_16 = 31_u16;
        let aqa = (aqa_high_16 as u32) << 16 | aqa_low_16 as u32;
        let aqa_address = bar + NVME_REG_AQA;

        // 将admin queue配置信息写入nvme设备寄存器AQA (admin_queue_attributes)
        unsafe {
            write_volatile(aqa_address as *mut u32, aqa);
        }

        // 将admin queue的sq dma物理地址写入nvme设备上的寄存器ASQ
        let asq_address = bar + NVME_REG_ASQ;
        unsafe {
            write_volatile(asq_address as *mut u32, sq_dma_pa);
        }
.................

This is because it converts a pointer of type 'usize' to a pointer of type 'u32', which requires 4-byte alignment, while a pointer of type 'usize' does not guarantee this alignment. This can result in undefined behavior (UB).

@lwz23
Copy link
Author

lwz23 commented Jan 2, 2025

same for

pub fn nvme_alloc_io_queue(&mut self) {

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant