[PATCH v3 0/2] nvme-tcp: two checks on the C2HData receive path

[Yehyeong Lee]

Two problems on the nvme-tcp host receive path, both reachable by a
controller sending a C2HData PDU that does not match the command.

1/2: nothing compares the bytes actually received against the length the
command asked for, so a 4096-byte read answered with 512 bytes completes
as fully successful.

2/2: the C2HData gate reads blk_rq_payload_bytes() without first
checking blk_rq_nr_phys_segments(), the rule commit 25e5cb780e62
("nvme-tcp: fix possible crash in write_zeroes processing") established
for the send path.

v3 fixes two defects a reviewer found in v2: a CQE phase tag evaded the
success test in 1/2, and 2/2 had stopped rejecting a C2HData naming an
idle tag. Both are measured; the notes under --- have the detail.

Reproduced on v7.2-rc5 against a test target on loopback; no real hardware.

Link: https://lore.kernel.org/r/20260801060201.1879499-1-yhlee@xxxxxxxxxxxxxxxxxx

Yehyeong Lee (2):
  nvme-tcp: reject a read that transferred too few bytes
  nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone

 drivers/nvme/host/tcp.c | 38 +++++++++++++++++++++++++++++++++++++-
 1 file changed, 37 insertions(+), 1 deletion(-)

-- 
2.43.0