Re: [PATCH 1/2] nvme: bound ns descriptor header and body to identify buffer

[Christoph Hellwig]

On Thu, Jul 09, 2026 at 02:30:32PM +0200, Greg Kroah-Hartman wrote:
> From: Hari Mishal <harimishal1@xxxxxxxxx>
> 
> nvme_identify_ns_descs() allocates a buffer and gives it to the
> controller, which populates it and then iterates the buffer with
> variable byte increments that vary by type and body size.  But, there is
> no bounds check inside the iteration itself except the loop bound
> itself.  Fix this by checking and stopping iteration if the next header
> or its declared body would go past the buffer itself.

Looks good:

Reviewed-by: Christoph Hellwig <hch@xxxxxx>