Re: [PATCH] nvme-tcp: check the data direction of a C2HData PDU

[Keith Busch]

On Tue, Aug 18, 2026 at 08:04:05PM +0900, Yehyeong Lee wrote:
> nvme_tcp_handle_c2h_data() finds the request by command id and checks
> that it has a payload, but it does not check that the command asked for
> data to be read.  A controller that answers a write command with C2HData
> therefore reaches nvme_tcp_recv_data(), where _copy_to_iter() hits
> WARN_ON_ONCE(i->data_source) and returns 0.  The receive path turns that
> into -EFAULT and resets the controller.

Thanks, applied to nvme-7.3.