[PATCH v3 0/2] nvme-tcp: two checks on the C2HData receive path

[Keith Busch]

On Sat, Aug 01, 2026 at 05:18:16PM +0900, Yehyeong Lee wrote:
> Two problems on the nvme-tcp host receive path, both reachable by a
> controller sending a C2HData PDU that does not match the command.
> 
> 1/2: nothing compares the bytes actually received against the length the
> command asked for, so a 4096-byte read answered with 512 bytes completes
> as fully successful.
> 
> 2/2: the C2HData gate reads blk_rq_payload_bytes() without first
> checking blk_rq_nr_phys_segments(), the rule commit 25e5cb780e62
> ("nvme-tcp: fix possible crash in write_zeroes processing") established
> for the send path.

This looks good to me. I'll get this queued up if I don't hear any
concerns.