From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 19A7E41C308 for ; Thu, 9 Jul 2026 12:30:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783600238; cv=none; b=E3R6VhTts1YJ6PBmoZKYuPjINpG79rEim5N9Sx3raRWx+VynyfMgGn89cXYT33foBJSzQ/ItI1sGaW1jn98dxSLxJfY0b5x3zrTOsd7LRXege3tkYQtc08BYy3h27SgIaozda9mCLiKpUZNQZ+5nxOWjte+UceL3/kSR2LdQck4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783600238; c=relaxed/simple; bh=HkLBNwIT7Cwzc7c/EpYhl9QFx0aN2f8qMSEapB0ULcU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=fU3s6iY7MTZHy+rKXiA4yy4vcsa7C77U1dXW5SmPwlsVcZjIZk6dBz3TzwlD9yU8oC4yC7ptZNzhUk72RQwVx9mVVau0NuTQ2uHPU96ZeRL4AI1mEOqwiWb2zm0LaMBGGoKqanu0KIFN430a0HV4bkA07U8q2BY8+l1v2gy/EEM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=1NWYhZ+o; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="1NWYhZ+o" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 200051F000E9; Thu, 9 Jul 2026 12:30:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1783600236; bh=K8rZsYfKqh8ovcXw7o3S/4TJwBou6C72ZHTzfJTtwDE=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=1NWYhZ+oO8VtYC7OeI728VPfofHDsj3u2KheK2X+n/5CMebga0B//jvmwa1lKDmEl xtuX228jXtrFm766jrg9kkKA/mPoWaSP1wxICLzhgdN0PkKxBRBCBTrU8QJc9KxvnE IRxblEi5HCpJ9dvuo7Y7AFGKOB3w5tjNk5gVSxzY= From: Greg Kroah-Hartman To: linux-nvme@lists.infradead.org Cc: linux-kernel@vger.kernel.org, Hari Mishal , Keith Busch , Jens Axboe , Christoph Hellwig , Sagi Grimberg , Greg Kroah-Hartman Subject: [PATCH 2/2] nvme: clamp FDP nruhsd to allocated RUH status descriptor count Date: Thu, 9 Jul 2026 14:30:33 +0200 Message-ID: <2026070932-fried-frying-9c36@gregkh> X-Mailer: git-send-email 2.55.0 In-Reply-To: <2026070931-stopping-cost-239a@gregkh> References: <2026070931-stopping-cost-239a@gregkh> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=1304; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=PA8MEk/isiRvoD4Y1PDdctB4RwX1e1zanaIxVF2oOsc=; b=owGbwMvMwCRo6H6F97bub03G02pJDFn+UzL+TeU99PVX0XulTRUHYq/xxenMf1KQw7Hh0VVFR mfeKpvzHbEsDIJMDLJiiixftvEc3V9xSNHL0PY0zBxWJpAhDFycAjARmakMC67Vpl53sTKQ6dyo IZ7wYkn8ivLH1xgWdKT9jHhWdfxwu3DLlZk/Onz27fVjBwA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Hari Mishal nvme_query_fdp_info() allocates the RUH status buffer for at most S8_MAX - 1 descriptors, and then copies ruhs->ruhsd[] into head->plids[] using the controller reported ruhs->nruhsd directly as the loop bound. However, that count wasn't taken into account for the actual buffer's size, so there was a chance for a controller reporting a larger nruhsd to cause the copy to overflow the buffer. Clamp nr_plids to the same bound used for the allocation. Assisted-by: gkh_clanker_t1000 Cc: Keith Busch Cc: Jens Axboe Cc: Christoph Hellwig Cc: Sagi Grimberg Signed-off-by: Hari Mishal Signed-off-by: Greg Kroah-Hartman --- drivers/nvme/host/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c index 6505da5c5ebe..62a7adfdab99 100644 --- a/drivers/nvme/host/core.c +++ b/drivers/nvme/host/core.c @@ -2361,7 +2361,7 @@ static int nvme_query_fdp_info(struct nvme_ns *ns, struct nvme_ns_info *info) goto free; } - head->nr_plids = le16_to_cpu(ruhs->nruhsd); + head->nr_plids = min(le16_to_cpu(ruhs->nruhsd), S8_MAX - 1); if (!head->nr_plids) goto free; -- 2.55.0