Commit 7e210d5e authored by Jens Axboe's avatar Jens Axboe
Browse files

Merge tag 'nvme-6.19-2026-02-05' of git://git.infradead.org/nvme into block-6.19 

Pull NVMe fixes from Keith:

"- Fix NULL pointer access setting up dma mappings (Keith)
 - Fix invalid memory access from malformed TCP PDU (YunJe)"

* tag 'nvme-6.19-2026-02-05' of git://git.infradead.org/nvme:
  nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec
  nvme-pci: handle changing device dma map requirements
parents 4da7c5c3 52a0a985

drivers/nvme/host/pci.c

+30 −15
Original line number Diff line number Diff line
@@ -816,21 +816,42 @@ static void nvme_unmap_data(struct request *req) 
		nvme_free_descriptors(req);

}



static bool nvme_pci_prp_iter_next(struct request *req, struct device *dma_dev,

static bool nvme_pci_prp_save_mapping(struct request *req,

				      struct device *dma_dev,

				      struct blk_dma_iter *iter)

{

	struct nvme_iod *iod = blk_mq_rq_to_pdu(req);



	if (iter->len)

	if (dma_use_iova(&iod->dma_state) || !dma_need_unmap(dma_dev))

		return true;

	if (!blk_rq_dma_map_iter_next(req, dma_dev, &iod->dma_state, iter))



	if (!iod->nr_dma_vecs) {

		struct nvme_queue *nvmeq = req->mq_hctx->driver_data;



		iod->dma_vecs = mempool_alloc(nvmeq->dev->dmavec_mempool,

				GFP_ATOMIC);

		if (!iod->dma_vecs) {

			iter->status = BLK_STS_RESOURCE;

			return false;

	if (!dma_use_iova(&iod->dma_state) && dma_need_unmap(dma_dev)) {

		}

	}



	iod->dma_vecs[iod->nr_dma_vecs].addr = iter->addr;

	iod->dma_vecs[iod->nr_dma_vecs].len = iter->len;

	iod->nr_dma_vecs++;

	return true;

}



static bool nvme_pci_prp_iter_next(struct request *req, struct device *dma_dev,

		struct blk_dma_iter *iter)

{

	struct nvme_iod *iod = blk_mq_rq_to_pdu(req);



	if (iter->len)

		return true;

	if (!blk_rq_dma_map_iter_next(req, dma_dev, &iod->dma_state, iter))

		return false;

	return nvme_pci_prp_save_mapping(req, dma_dev, iter);

}



static blk_status_t nvme_pci_setup_data_prp(struct request *req,
@@ -843,15 +864,8 @@ static blk_status_t nvme_pci_setup_data_prp(struct request *req, 
	unsigned int prp_len, i;

	__le64 *prp_list;



	if (!dma_use_iova(&iod->dma_state) && dma_need_unmap(nvmeq->dev->dev)) {

		iod->dma_vecs = mempool_alloc(nvmeq->dev->dmavec_mempool,

				GFP_ATOMIC);

		if (!iod->dma_vecs)

			return BLK_STS_RESOURCE;

		iod->dma_vecs[0].addr = iter->addr;

		iod->dma_vecs[0].len = iter->len;

		iod->nr_dma_vecs = 1;

	}

	if (!nvme_pci_prp_save_mapping(req, nvmeq->dev->dev, iter))

		return iter->status;



	/*

	 * PRP1 always points to the start of the DMA transfers.
@@ -1219,6 +1233,7 @@ static blk_status_t nvme_prep_rq(struct request *req) 
	iod->nr_descriptors = 0;

	iod->total_len = 0;

	iod->meta_total_len = 0;

	iod->nr_dma_vecs = 0;



	ret = nvme_setup_cmd(req->q->queuedata, req);

	if (ret)

drivers/nvme/target/tcp.c

+17 −0
Original line number Diff line number Diff line
@@ -349,11 +349,14 @@ static void nvmet_tcp_free_cmd_buffers(struct nvmet_tcp_cmd *cmd) 
	cmd->req.sg = NULL;

}



static void nvmet_tcp_fatal_error(struct nvmet_tcp_queue *queue);



static void nvmet_tcp_build_pdu_iovec(struct nvmet_tcp_cmd *cmd)

{

	struct bio_vec *iov = cmd->iov;

	struct scatterlist *sg;

	u32 length, offset, sg_offset;

	unsigned int sg_remaining;

	int nr_pages;



	length = cmd->pdu_len;
@@ -361,9 +364,22 @@ static void nvmet_tcp_build_pdu_iovec(struct nvmet_tcp_cmd *cmd) 
	offset = cmd->rbytes_done;

	cmd->sg_idx = offset / PAGE_SIZE;

	sg_offset = offset % PAGE_SIZE;

	if (!cmd->req.sg_cnt || cmd->sg_idx >= cmd->req.sg_cnt) {

		nvmet_tcp_fatal_error(cmd->queue);

		return;

	}

	sg = &cmd->req.sg[cmd->sg_idx];

	sg_remaining = cmd->req.sg_cnt - cmd->sg_idx;



	while (length) {

		if (!sg_remaining) {

			nvmet_tcp_fatal_error(cmd->queue);

			return;

		}

		if (!sg->length || sg->length <= sg_offset) {

			nvmet_tcp_fatal_error(cmd->queue);

			return;

		}

		u32 iov_len = min_t(u32, length, sg->length - sg_offset);



		bvec_set_page(iov, sg_page(sg), iov_len,
@@ -371,6 +387,7 @@ static void nvmet_tcp_build_pdu_iovec(struct nvmet_tcp_cmd *cmd) 


		length -= iov_len;

		sg = sg_next(sg);

		sg_remaining--;

		iov++;

		sg_offset = 0;

	}