[PATCH v2] nvmet-tcp: set a default MDTS of 2 MiB for TCP transport

[Maurizio Lombardi]

On Mon Apr 27, 2026 at 2:44 AM CEST, Shivam Kumar wrote:
> Unlike other fabrics transports, the TCP target does not set a default
> Maximum Data Transfer Size. With the configfs MDTS entry defaulting to 0
> (no limit), a remote attacker can send a CapsuleCmd with an arbitrarily
> large SGL length, causing sgl_alloc() in nvmet_tcp_map_data() to attempt
> an excessive kernel allocation that triggers the OOM killer.
>
> Set a default MDTS of 9 (2 MiB) for TCP. Admins can still adjust via
> the configfs mdts attribute if needed.
>
> Signed-off-by: Shivam Kumar <kumar.shivam43666 at gmail.com>
> ---
>  drivers/nvme/target/tcp.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c
> index a456dd2fd8bd..d09c81d07a1d 100644
> --- a/drivers/nvme/target/tcp.c
> +++ b/drivers/nvme/target/tcp.c
> @@ -25,6 +25,7 @@
>  #define NVMET_TCP_DEF_INLINE_DATA_SIZE	(4 * PAGE_SIZE)
>  #define NVMET_TCP_MAXH2CDATA		0x400000 /* 16M arbitrary limit */
>  #define NVMET_TCP_BACKLOG 128
> +#define NVMET_TCP_DEF_MDTS		9 /* 2 MiB (2^(12+9)) */
>  
>  static int param_store_val(const char *str, int *val, int min, int max)
>  {
> @@ -2067,6 +2068,8 @@ static int nvmet_tcp_add_port(struct nvmet_port *nport)
>  	INIT_WORK(&port->accept_work, nvmet_tcp_accept_work);
>  	if (port->nport->inline_data_size < 0)
>  		port->nport->inline_data_size = NVMET_TCP_DEF_INLINE_DATA_SIZE;
> +	if (nport->mdts < 0)
> +		nport->mdts = NVMET_TCP_DEF_MDTS;
>  
>  	ret = sock_create(port->addr.ss_family, SOCK_STREAM,
>  				IPPROTO_TCP, &port->sock);

Ok, but what happens if a host doesn't respect the limitation advertized
by the target?

The spec explicitely says that "If a command is submitted that exceeds this transfer
size, then the command is aborted with a status code of Invalid Field in
Command."

Maurizio