Re: [PATCH v3] mpt3sas: Limit NVMe request size to 2 MiB

[Damien Le Moal <dlemoal@kernel.org>]

On 2026/04/13 22:33, David Laight wrote:
> On Mon, 13 Apr 2026 23:30:03 +0530
> Ranjan Kumar <ranjan.kumar@broadcom.com> wrote:
> 
>> The HBA firmware reports NVMe MDTS values based on the underlying drive
>> capability. However, due to the 4K PRP page size and a limit of
>> 512 entries, the driver supports a maximum I/O transfer size of 2 MiB.
>>
>> Limit max_hw_sectors to the smaller of the reported MDTS and the
>> 2 MiB driver limit to prevent issuing oversized I/O that may lead
>> to a kernel oops.
>>
>> Cc: stable@vger.kernel.org
>> Fixes: 9b8b84879d4a ("block: Increase BLK_DEF_MAX_SECTORS_CAP")
>> Reported-by: Mira Limbeck <m.limbeck@proxmox.com>
>> Closes: https://lore.kernel.org/r/291f78bf-4b4a-40dd-867d-053b36c564b3@proxmox.com
>> Link: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9b8b84879d4a
>> Suggested-by: Keith Busch <kbusch@kernel.org>
>> Signed-off-by: Ranjan Kumar <ranjan.kumar@broadcom.com>
>> ---
>>  drivers/scsi/mpt3sas/mpt3sas_scsih.c | 14 +++++++++++++-
>>  1 file changed, 13 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
>> index 6ff788557294..44dd439e6f17 100644
>> --- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c
>> +++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
>> @@ -2738,8 +2738,20 @@ scsih_sdev_configure(struct scsi_device *sdev, struct queue_limits *lim)
>>  				pcie_device->enclosure_level,
>>  				pcie_device->connector_name);
>>  
>> +		/*
>> +		 * The HBA firmware passes the NVMe drive's MDTS
>> +		 * (Maximum Data Transfer Size) up to the driver. However,
>> +		 * the driver hardcodes a 4K page size for the PRP list,
>                                              ^ buffer ? 
>> +		 * accommodating at most 512 entries. This strictly limits
>> +		 * the maximum supported NVMe I/O transfer to 2 MiB.
> 
> Doesn't that make max_fw_entries 4096/8.

What is max_fw_entries ?
What the above explains is that a single NVMe page (4K) can store 512 (4096/8)
PRP entries, each pointing at a 4K nvme page, so 512*4096=2M maximum size.

> Assuming 4096 byte sectors the longest transfer is then 4096/8*4096.

Yes, that's the SZ_2M Bytes.

> So none of this has anything to to with SECTOR_SHIFT.

Apparently, nvme_mdts is in bytes, even though the documentation in
mpt3sas_base.h does not mention anything about its unit. So yes, we need a
SECTOR_SHIFT to convert that to 512B sectors unit.

> 
>> +		 *
>> +		 * Cap max_hw_sectors to the smaller of the drive's reported
>> +		 * MDTS or the 2 MiB driver limit to prevent kernel oopses.
>> +		 */
>> +		lim->max_hw_sectors = SZ_2M >> SECTOR_SHIFT;
>>  		if (pcie_device->nvme_mdts)
>> -			lim->max_hw_sectors = pcie_device->nvme_mdts / 512;
>> +			lim->max_hw_sectors = min_t(u32, lim->max_hw_sectors,
>> +					pcie_device->nvme_mdts >> SECTOR_SHIFT);
> 
> Why min_t() ?

max_hw_sectors is unsigned int and nvme_mdts is u32. Not sure if that bothers
min(). Worth trying.

> 
> David
> 
>>  
>>  		pcie_device_put(pcie_device);
>>  		spin_unlock_irqrestore(&ioc->pcie_device_lock, flags);
> 


-- 
Damien Le Moal
Western Digital Research