Re: [PATCH v3] nvme-pci: fix CMB mapping when CMBSZ Size field is zero

[sashiko-bot@kernel.org]

> The controller memory buffer size is defined by the SZ field in the
> CMBSZ register (bits 31:12). According to the NVMe specification, a
> value of zero in the SZ field indicates that no CMB is present.
> 
> Commit f65efd6dfe4e ("nvme-pci: clean up CMB initialization") replaced
> the check for a zero SZ field with a check for a zero CMBSZ register
> value, under the assumption that a zero register implies no CMB.
> However, a CMBSZ register can be non-zero while the SZ field is zero,
> for example when Size Units (SZU) is set to a non-zero value but the
> actual size is zero (e.g. CMBSZ = 0x100: SZU = 1, SZ = 0).
> 
> When this happens, nvme_map_cmb() proceeds to compute a size of zero,
> passes the alignment checks (zero is always aligned), and calls
> pci_p2pdma_add_resource() with size=0. The P2PDMA subsystem then
> defaults size to the entire remaining BAR, which may not be properly
> [ ... ]
>    to detect integer overflow that could wrap to a non-zero value and
>    bypass the SZ check.
> 
> Fixes: f65efd6dfe4e ("nvme-pci: clean up CMB initialization")
> Signed-off-by: kangfenglong <kangfenglong@huawei.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260622024129.40800-1-kangfenglong@huawei.com?part=1