Two problems on the nvme-tcp host receive path, both reachable by a
controller sending a C2HData PDU that does not match the command.
1/2: nothing compares the bytes actually received against the length the
command asked for, so a 4096-byte read answered with 512 bytes completes
as fully successful.
2/2: the C2HData gate reads blk_rq_payload_bytes() without first
checking blk_rq_nr_phys_segments(), the rule commit 25e5cb780e62
("nvme-tcp: fix possible crash in write_zeroes processing") established
for the send path.
v3 fixes two defects a reviewer found in v2: a CQE phase tag evaded the
success test in 1/2, and 2/2 had stopped rejecting a C2HData naming an
idle tag. Both are measured; the notes under --- have the detail.
Reproduced on v7.2-rc5 against a test target on loopback; no real hardware.
Link: https://lore.kernel.org/r/20260801060201.1879499-1-yhlee@isslab.korea.ac.kr
Yehyeong Lee (2):
nvme-tcp: reject a read that transferred too few bytes
nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone
drivers/nvme/host/tcp.c | 38 +++++++++++++++++++++++++++++++++++++-
1 file changed, 37 insertions(+), 1 deletion(-)
--
2.43.0