[PATCH v3 0/5] nvme: a few error-path and validation fixes

[Guixin Liu <kanie@linux.alibaba.com>]

This series collects independent fixes found while auditing error and
command-processing paths in the NVMe host and target drivers. Each is
standalone; they only share the same subsystem.

  1. nvmet: an Identify CNS 07h (active NS list for a command set)
     dereferences req->ns, which is always NULL on that path -> NULL
     pointer oops. Also fixes the filter to test the iterated ns->csi.

  2. nvmet: nvmet_ns_enable() ignores the percpu_ref_init() return value
     and reports success to userspace when it fails, leaving the ns dead.

  3. nvme-pci: the per-NUMA-node descriptor DMA pools, created lazily on
     admin tag set allocation, are only freed in nvme_remove(); a probe
     failure after that point leaks them.

  4. nvme: nvme_query_fdp_info() trusts the device-supplied nruhsd count
     and can read past the fixed-size RUH status buffer (heap OOB read).

  5. nvme: follow-up to #4, suggested by Kanchan -- the RUH status buffer
     and the placement handle clamp used the odd S8_MAX - 1 value; raise
     the cap to the meaningful U8_MAX (bio->bi_write_stream is u8) and
     warn on overflow.

Found by code audit. #1 and #2 are functional/crash fixes; #3 is a
resource leak; #4 is device-triggered hardening; #5 tidies up the cap
introduced by #4.

A blktests regression test for #1 (Identify CNS 07h) will be sent
separately to the blktests list.

v2 -> v3:
  - patch 5: addressed Kanchan's review -- move the overflow check below
    the zero-length check and fold the clamp into the warn branch (drop
    min_t, assign NVME_MAX_PLIDS directly); collected his Reviewed-by.

v1 -> v2:
  - Collected Reviewed-by tags from Hannes, Christoph, Kanchan and Nilay,
    thanks.
  - patch 1: added the observed NULL-deref oops splat to the commit log.
  - Added patch 5 (raise the FDP handle cap to U8_MAX and warn on
    overflow), as discussed on patch 4 with Keith, Christoph and Kanchan.

Guixin Liu (5):
  nvmet: fix NULL pointer dereference in nvmet_execute_identify_nslist()
  nvmet: propagate percpu_ref_init() failure in nvmet_ns_enable()
  nvme-pci: release descriptor pools on probe failure
  nvme: clamp FDP placement handle count to the buffer size
  nvme: raise FDP placement handle cap to U8_MAX and warn on overflow

 drivers/nvme/host/core.c        | 16 +++++++++++++++-
 drivers/nvme/host/pci.c         |  1 +
 drivers/nvme/target/admin-cmd.c |  2 +-
 drivers/nvme/target/core.c      |  3 ++-
 4 files changed, 19 insertions(+), 3 deletions(-)


base-commit: 11028ab62899e4191e074ee364c712b77823a9c4
-- 
2.43.7