git: 34f131f1de85 - main - nvme: bound the AER error log byte-swap by the fetched length

The branch main has been updated by seuros:

URL: https://cgit.FreeBSD.org/src/commit/?id=34f131f1de853ae824a6e67dd6429332d23b373d

commit 34f131f1de853ae824a6e67dd6429332d23b373d
Author:     Abdelkader Boudih <seuros@FreeBSD.org>
AuthorDate: 2026-09-23 18:02:38 +0000
Commit:     Abdelkader Boudih <seuros@FreeBSD.org>
CommitDate: 2026-09-23 18:02:38 +0000

    nvme: bound the AER error log byte-swap by the fetched length
    
    The Get Log Page request for the error log is clamped to
    NVME_MAX_AER_LOG_SIZE, but the byte-swap loop iterated ELPE + 1
    entries. A controller reporting more than 63 entries makes the loop
    overrun the 4 KiB log page buffer.
    
    Reviewed by:    ngie, imp, adrian
    Differential Revision:  https://reviews.freebsd.org/D59626
---
 sys/dev/nvme/nvme_ctrlr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sys/dev/nvme/nvme_ctrlr.c b/sys/dev/nvme/nvme_ctrlr.c
index 6dba83708df4..6d2749b90b20 100644
--- a/sys/dev/nvme/nvme_ctrlr.c
+++ b/sys/dev/nvme/nvme_ctrlr.c
@@ -1291,7 +1291,7 @@ nvme_ctrlr_aer_task(void *arg, int pending)
 	case NVME_LOG_ERROR: {
 		struct nvme_error_information_entry *err =
 		    (struct nvme_error_information_entry *)aer->log_page_buffer;
-		for (int i = 0; i < (aer->ctrlr->cdata.elpe + 1); i++)
+		for (uint32_t i = 0; i < aer->log_page_size / sizeof(*err); i++)
 			nvme_error_information_entry_swapbytes(err++);
 		break;
 	}