[PATCH 0/4] nvme: a few error-path and validation fixes

[Guixin Liu <kanie@linux.alibaba.com>]

This series collects four independent fixes found while auditing error
and command-processing paths in the NVMe host and target drivers. Each
is standalone; they only share the same subsystem.

  1. nvmet: an Identify CNS 07h (active NS list for a command set)
     dereferences req->ns, which is always NULL on that path -> NULL
     pointer oops. Also fixes the filter to test the iterated ns->csi.

  2. nvmet: nvmet_ns_enable() ignores the percpu_ref_init() return value
     and reports success to userspace when it fails, leaving the ns dead.

  3. nvme-pci: the per-NUMA-node descriptor DMA pools, created lazily on
     admin tag set allocation, are only freed in nvme_remove(); a probe
     failure after that point leaks them.

  4. nvme: nvme_query_fdp_info() trusts the device-supplied nruhsd count
     and can read past the fixed-size RUH status buffer (heap OOB read).

Found by code audit. #1 and #2 are functional/crash fixes; #3 is a
resource leak; #4 is device-triggered hardening. Compile-tested.

Guixin Liu (4):
  nvmet: fix NULL pointer dereference in nvmet_execute_identify_nslist()
  nvmet: propagate percpu_ref_init() failure in nvmet_ns_enable()
  nvme-pci: release descriptor pools on probe failure
  nvme: clamp FDP placement handle count to the buffer size

 drivers/nvme/host/core.c        | 1 +
 drivers/nvme/host/pci.c         | 1 +
 drivers/nvme/target/admin-cmd.c | 2 +-
 drivers/nvme/target/core.c      | 3 ++-
 4 files changed, 5 insertions(+), 2 deletions(-)


base-commit: 11028ab62899e4191e074ee364c712b77823a9c4
-- 
2.43.7