[PATCH nvmet-v1 0/1] nvmet: zns: reject full zone report when buffer is too small

[PATCH nvmet-v1 0/1] nvmet: zns: reject full zone report when buffer is too small

[Xixin Liu]

Hi,

A Zone Management Receive partial report (PR bit set) may return fewer zone
descriptors than zones matched.  A full report (PR bit clear) must fit
every matching descriptor in the data buffer.

nvmet already caps Number of Zones on partial reports, but may return success
on a full report when the buffer is too small.  Reject those commands with
INVALID_FIELD.

Tested on nvmet-tcp loopback with io-passthru.

Thanks,
Xixin Liu

---

Xixin Liu (1):
  nvmet: zns: reject full zone report when buffer is too small

 drivers/nvme/target/zns.c | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

-- 
2.43.0

[PATCH nvmet-v1 1/1] nvmet: zns: reject full zone report when buffer is too small

[Xixin Liu]

Zone Management Receive uses the Partial Report (PR) bit in dword 13.  On a
partial report (PR bit set), the host accepts an incomplete listing and
Number of Zones must not exceed the zone descriptors copied to the host
buffer.  On a full report (PR bit clear), Number of Zones is the total
number of matching zones and every descriptor must fit in the buffer (ZNS
Command Set Specification Rev 1.2, section 3.4.2).

nvmet_bdev_zone_zmgmt_recv_work() already caps Number of Zones for partial
reports, but on a full report it may still succeed when the buffer only
holds part of the matching descriptors.  Reject the command in that case.

Signed-off-by: Xixin Liu <liuxixin@kylinos.cn>
---
 drivers/nvme/target/zns.c | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/drivers/nvme/target/zns.c b/drivers/nvme/target/zns.c
index f00921931eb6..a53986fcc04a 100644
--- a/drivers/nvme/target/zns.c
+++ b/drivers/nvme/target/zns.c
@@ -295,11 +295,20 @@ static void nvmet_bdev_zone_zmgmt_recv_work(struct work_struct *w)
 	}
 
 	/*
-	 * When partial bit is set nr_zones must indicate the number of zone
-	 * descriptors actually transferred.
+	 * Partial report (PR bit set): the host accepts an incomplete listing,
+	 * so cap Number of Zones to the descriptors that fit in the buffer.
+	 * Full report (PR bit clear): Number of Zones is the match count; fail
+	 * if the buffer cannot hold every matching zone descriptor.
 	 */
-	if (req->cmd->zmr.pr)
+	if (req->cmd->zmr.pr) {
 		rz_data.nr_zones = min(rz_data.nr_zones, rz_data.out_nr_zones);
+	} else {
+		if (rz_data.nr_zones > rz_data.out_nr_zones) {
+			req->error_loc = offsetof(struct nvme_zone_mgmt_recv_cmd, numd);
+			status = NVME_SC_INVALID_FIELD | NVME_STATUS_DNR;
+			goto out;
+		}
+	}
 
 	nr_zones = cpu_to_le64(rz_data.nr_zones);
 	status = nvmet_copy_to_sgl(req, 0, &nr_zones, sizeof(nr_zones));
-- 
2.43.0

Re: [PATCH nvmet-v1 1/1] nvmet: zns: reject full zone report when buffer is too small

[Christoph Hellwig]

On Thu, Jul 09, 2026 at 02:51:39PM +0800, Xixin Liu wrote:
> Zone Management Receive uses the Partial Report (PR) bit in dword 13.  On a
> partial report (PR bit set), the host accepts an incomplete listing and
> Number of Zones must not exceed the zone descriptors copied to the host
> buffer.  On a full report (PR bit clear), Number of Zones is the total
> number of matching zones and every descriptor must fit in the buffer (ZNS
> Command Set Specification Rev 1.2, section 3.4.2).
> 
> nvmet_bdev_zone_zmgmt_recv_work() already caps Number of Zones for partial
> reports, but on a full report it may still succeed when the buffer only
> holds part of the matching descriptors.  Reject the command in that case.
> 
> Signed-off-by: Xixin Liu <liuxixin@kylinos.cn>
> ---
>  drivers/nvme/target/zns.c | 15 ++++++++++++---
>  1 file changed, 12 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/nvme/target/zns.c b/drivers/nvme/target/zns.c
> index f00921931eb6..a53986fcc04a 100644
> --- a/drivers/nvme/target/zns.c
> +++ b/drivers/nvme/target/zns.c
> @@ -295,11 +295,20 @@ static void nvmet_bdev_zone_zmgmt_recv_work(struct work_struct *w)
>  	}
>  
>  	/*
> -	 * When partial bit is set nr_zones must indicate the number of zone
> -	 * descriptors actually transferred.
> +	 * Partial report (PR bit set): the host accepts an incomplete listing,
> +	 * so cap Number of Zones to the descriptors that fit in the buffer.
> +	 * Full report (PR bit clear): Number of Zones is the match count; fail
> +	 * if the buffer cannot hold every matching zone descriptor.
>  	 */
> -	if (req->cmd->zmr.pr)
> +	if (req->cmd->zmr.pr) {
>  		rz_data.nr_zones = min(rz_data.nr_zones, rz_data.out_nr_zones);
> +	} else {
> +		if (rz_data.nr_zones > rz_data.out_nr_zones) {
> +			req->error_loc = offsetof(struct nvme_zone_mgmt_recv_cmd, numd);

Overly line here.  Easily fixed by using and else if above.

Re: [PATCH nvmet-v2 1/1] nvmet: zns: reject full zone report when buffer is too small

[Christoph Hellwig]

Looks good:

Reviewed-by: Christoph Hellwig <hch@lst.de>

[PATCH nvmet-v2 1/1] nvmet: zns: reject full zone report when buffer is too small

[Xixin Liu]

Zone Management Receive uses the Partial Report (PR) bit in dword 13.  On a
partial report (PR bit set), the host accepts an incomplete listing and
Number of Zones must not exceed the zone descriptors copied to the host
buffer.  On a full report (PR bit clear), Number of Zones is the total
number of matching zones and every descriptor must fit in the buffer (ZNS
Command Set Specification Rev 1.2, section 3.4.2).

nvmet_bdev_zone_zmgmt_recv_work() already caps Number of Zones for partial
reports, but on a full report it may still succeed when the buffer only
holds part of the matching descriptors.  Reject the command in that case.

Signed-off-by: Xixin Liu <liuxixin@kylinos.cn>
---
 drivers/nvme/target/zns.c | 13 +++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/drivers/nvme/target/zns.c b/drivers/nvme/target/zns.c
index f00921931eb6..c7e4a91f2b8d 100644
--- a/drivers/nvme/target/zns.c
+++ b/drivers/nvme/target/zns.c
@@ -295,11 +295,18 @@ static void nvmet_bdev_zone_zmgmt_recv_work(struct work_struct *w)
 	}
 
 	/*
-	 * When partial bit is set nr_zones must indicate the number of zone
-	 * descriptors actually transferred.
+	 * Partial report (PR bit set): the host accepts an incomplete listing,
+	 * so cap Number of Zones to the descriptors that fit in the buffer.
+	 * Full report (PR bit clear): Number of Zones is the match count; fail
+	 * if the buffer cannot hold every matching zone descriptor.
 	 */
-	if (req->cmd->zmr.pr)
+	if (req->cmd->zmr.pr) {
 		rz_data.nr_zones = min(rz_data.nr_zones, rz_data.out_nr_zones);
+	} else if (rz_data.nr_zones > rz_data.out_nr_zones) {
+		req->error_loc = offsetof(struct nvme_zone_mgmt_recv_cmd, numd);
+		status = NVME_SC_INVALID_FIELD | NVME_STATUS_DNR;
+		goto out;
+	}
 
 	nr_zones = cpu_to_le64(rz_data.nr_zones);
 	status = nvmet_copy_to_sgl(req, 0, &nr_zones, sizeof(nr_zones));
-- 
2.43.0

[PATCH nvmet-v2 0/1] nvmet: zns: reject full zone report when buffer is too small

[Xixin Liu]

Hi Christoph,

Thanks for the review — folded the nested if into else if.

Thanks,
Xixin Liu

---

Xixin Liu (1):
  nvmet: zns: reject full zone report when buffer is too small

 drivers/nvme/target/zns.c | 13 +++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

-- 
2.43.0