github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-23 05:04:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

nvmet: zns: reject full zone report when buffer is too small

Browse Source 
Zone Management Receive uses the Partial Report (PR) bit in dword 13.  On a
partial report (PR bit set), the host accepts an incomplete listing and
Number of Zones must not exceed the zone descriptors copied to the host
buffer.  On a full report (PR bit clear), Number of Zones is the total
number of matching zones and every descriptor must fit in the buffer (ZNS
Command Set Specification Rev 1.2, section 3.4.2).

nvmet_bdev_zone_zmgmt_recv_work() already caps Number of Zones for partial
reports, but on a full report it may still succeed when the buffer only
holds part of the matching descriptors.  Reject the command in that case.

Signed-off-by: Xixin Liu <liuxixin@kylinos.cn>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Keith Busch <kbusch@kernel.org>
This commit is contained in:
Xixin Liu 2026-07-13 18:00:00 +08:00 committed by Keith Busch
parent 36ac05f7cf
commit 86985da126
1 changed files with 10 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
drivers/nvme/target/zns.c
View File

@ -295,11 +295,18 @@ static void nvmet_bdev_zone_zmgmt_recv_work(struct work_struct *w)
}
/*
* When partial bit is set nr_zones must indicate the number of zone
* descriptors actually transferred.
* Partial report (PR bit set): the host accepts an incomplete listing,
* so cap Number of Zones to the descriptors that fit in the buffer.
* Full report (PR bit clear): Number of Zones is the match count; fail
* if the buffer cannot hold every matching zone descriptor.
*/
if (req->cmd->zmr.pr)
if (req->cmd->zmr.pr) {
rz_data.nr_zones = min(rz_data.nr_zones, rz_data.out_nr_zones);
} else if (rz_data.nr_zones > rz_data.out_nr_zones) {
req->error_loc = offsetof(struct nvme_zone_mgmt_recv_cmd, numd);
status = NVME_SC_INVALID_FIELD | NVME_STATUS_DNR;
goto out;
}
nr_zones = cpu_to_le64(rz_data.nr_zones);
status = nvmet_copy_to_sgl(req, 0, &nr_zones, sizeof(nr_zones));