From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from verein.lst.de (verein.lst.de [213.95.11.211]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D6E7631A55E for ; Wed, 27 May 2026 14:16:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=213.95.11.211 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779891419; cv=none; b=F6eT2IOk7KfH6l48brG97uAClxd//eu6uRY1oZImLxXOXQd8h0AUaJ4PhvIn5mI0C4eSLhdljnzBErmvdqBdj4BYQmBYgaqX2QLopRkhojqeeBrSOGv6W0sSrnXfz8JosuL1XCh5BFqeLKqqBJNdmDI+jEMUMT9iw1ul16qLi5k= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779891419; c=relaxed/simple; bh=elXKcQjLCecFAaqOvuGeuiDkeiYJHYgJwC/vbKFp5Z4=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=Bu11SpJUmYCjBkafpRfPgXqa8w0xhQOx/oi5gcuc3bA0/3S4QZGKwVGK5o0MWwwzHYF1+oWRVksRQcY3eFP9FfVWK5Cx+dkUfJv9xdaSIB3bfKCqkmxd+jnBnyIJYMeSWZ2QHD74la7WGcbD2E60zXhOL4YlyLi+kswax4q5vlY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=lst.de; spf=pass smtp.mailfrom=lst.de; arc=none smtp.client-ip=213.95.11.211 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=lst.de Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=lst.de Received: by verein.lst.de (Postfix, from userid 2407) id 8544A68B05; Wed, 27 May 2026 16:16:49 +0200 (CEST) Date: Wed, 27 May 2026 16:16:48 +0200 From: Christoph Hellwig To: Chao Shi Cc: linux-nvme@lists.infradead.org, Keith Busch , Christoph Hellwig , Sagi Grimberg , Jens Axboe , Tatsuya Sasaki , Maurizio Lombardi , linux-kernel@vger.kernel.org, Sungwoo Kim , Dave Tian , Weidong Zhu Subject: Re: [PATCH v5] nvme: reject passthrough of driver-managed Set Features Message-ID: <20260527141648.GA13404@lst.de> References: <20260523225629.3964037-1-coshi036@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260523225629.3964037-1-coshi036@gmail.com> User-Agent: Mutt/1.5.17 (2007-11-01) On Sat, May 23, 2026 at 06:56:29PM -0400, Chao Shi wrote: > Since commit b58da2d270db ("nvme: update keep alive interval when kato > is modified"), userspace can start keep-alive on any transport via a > Set Features (KATO) passthrough command. nvme_keep_alive_work() then > allocates with BLK_MQ_REQ_RESERVED, but nvme_alloc_admin_tag_set() > only reserves admin tags for fabrics, so the allocation trips > WARN_ON_ONCE() in blk_mq_get_tag() and fails: > > nvme nvme0: keep-alive failed: -11 > > More generally, several Set Features change controller state that the > driver manages itself and cannot react to correctly when set behind > its back from userspace. Reject these in nvme_cmd_allowed(): > > - KATO on non-fabrics (keep-alive is only armed for fabrics; on PCIe > it has no reserved tag and an active keep-alive harms idle power > states) > - Host Behavior Support, Host Memory Buffer, Number of Queues, and > Autonomous Power State Transition (all driver-managed) > > Keep Alive on fabrics is unchanged. I/O commands are unaffected as the > check is confined to the admin path (ns == NULL). > > Link: https://lore.kernel.org/linux-nvme/20260522162639.395802-1-coshi036@gmail.com/ > > Fixes: b58da2d270db ("nvme: update keep alive interval when kato is modified") > > Found by FuzzNvme(Syzkaller with FEMU fuzzing framework). > > Acked-by: Sungwoo Kim > Acked-by: Dave Tian > Acked-by: Weidong Zhu > Signed-off-by: Chao Shi > --- > > Reproducer for the keep-alive case (run as root on a PCIe NVMe device): > > #include > #include > #include > #include > #include > > int main(void) > { > struct nvme_admin_cmd cmd = {0}; > int fd = open("/dev/nvme0", O_RDWR); > if (fd < 0) { perror("open"); return 1; } > cmd.opcode = 0x09; /* SET_FEATURES */ > cmd.cdw10 = 0x0f; /* Feature ID: KATO */ > cmd.cdw11 = 5; /* KATO = 5 seconds */ > if (ioctl(fd, NVME_IOCTL_ADMIN_CMD, &cmd) < 0) { > perror("ioctl"); > return 1; > } > return 0; > } > > On an unpatched kernel, within ~kato/2 seconds after the program exits, > dmesg shows: > > nvme nvme0: keep alive interval updated from 0 ms to 5000 ms > WARNING: CPU: 0 PID: ... at block/blk-mq-tag.c:148 blk_mq_get_tag+... > nvme nvme0: keep-alive failed: -11 > > With this patch the ioctl fails with EACCES on non-fabrics. > > Changes since v4: > - Fold the check into the existing nvme_cmd_allowed() instead of a > separate helper, and reject additional driver-managed Set Features > (Host Behavior, Host Memory Buffer, Number of Queues, Autonomous > Power State Transition) in the same switch (Keith Busch). The admin > vs I/O distinction is now structural: the switch lives in the > ns == NULL branch, so I/O commands (e.g. Dataset Management, which > shares opcode 0x09 with Set Features) are never inspected. > > Changes since v3: > - Only inspect admin commands so a DSM I/O command is not wrongly > rejected (Keith Busch). > > Changes since v2: > - Reject the KATO passthrough on non-fabrics instead of reserving an > admin tag for all transports (Keith Busch, Christoph Hellwig). > > Changes since v1: > - v2 added a spec citation and quirk discussion, superseded by the > reject approach. > > drivers/nvme/host/ioctl.c | 33 +++++++++++++++++++++++++++------ > 1 file changed, 27 insertions(+), 6 deletions(-) > > diff --git a/drivers/nvme/host/ioctl.c b/drivers/nvme/host/ioctl.c > index a9c097dacad6..31784506e845 100644 > --- a/drivers/nvme/host/ioctl.c > +++ b/drivers/nvme/host/ioctl.c > @@ -14,8 +14,9 @@ enum { > NVME_IOCTL_PARTITION = (1 << 1), > }; > > -static bool nvme_cmd_allowed(struct nvme_ns *ns, struct nvme_command *c, > - unsigned int flags, bool open_for_write) > +static bool nvme_cmd_allowed(struct nvme_ctrl *ctrl, struct nvme_ns *ns, > + struct nvme_command *c, unsigned int flags, > + bool open_for_write) > { > u32 effects; > > @@ -50,6 +51,26 @@ static bool nvme_cmd_allowed(struct nvme_ns *ns, struct nvme_command *c, > case NVME_ID_CNS_CTRL: > return true; > } > + } else if (c->common.opcode == nvme_admin_set_features) { > + /* > + * Reject Set Features that change controller state the > + * driver manages itself; setting them behind the driver's > + * back from userspace leaves it unable to react correctly. Overly long lines. I suspect we're best off splitting out the admin and ns-command set specific parts of nvme_cmd_allowed into separate helpers. And maybe use a switch statement on the command as nested ifs become cumersome in the long run. > - if (!nvme_cmd_allowed(ns, &c, 0, ioucmd->file->f_mode & FMODE_WRITE)) > + if (!nvme_cmd_allowed(ctrl, ns, &c, 0, ioucmd->file->f_mode & FMODE_WRITE)) Another overly long line here. Otherwise this looks good.