Re: [PATCH] scsi: megaraid_sas: Limit NVMe request size to the PRP chain frame

[Martin K. Petersen (Oracle)]

On Thu, 27 Aug 2026 19:24:24 +0200, Thomas Lamprecht wrote:

> megasas_make_prp_nvme() builds a command's PRP list in cmd->sg_frame, a
> DMA pool buffer of instance->max_chain_frame_sz bytes, spending one entry
> per NVMe page of the transfer plus one per page of the buffer for the
> chain pointer. The loop runs until the transfer is described and never
> checks the buffer bound.
> 
> max_hw_sectors comes straight from the MDTS the firmware reports for the
> drive. On drives with a large MDTS the only thing keeping the list inside
> the buffer was the block layer default of 1280 KiB, which needs 320
> entries, which fit into a 4 KiB frame as that holds 512. But since commit
> 9b8b84879d4a ("block: Increase BLK_DEF_MAX_SECTORS_CAP") that default is
> 4 MiB, and such a transfer needs 1025 entries, so the list runs a full
> page past the end of the frame:
> 
> [...]

Applied to 7.3/scsi-fixes, thanks!

[1/1] scsi: megaraid_sas: Limit NVMe request size to the PRP chain frame
      https://git.kernel.org/mkp/scsi/c/af8c27375733

-- 
Martin K. Petersen