Prior report for the nvmet-tcp unbounded SGL length fix in 7.3

[Maurizio Lombardi]

On Mon Aug 24, 2026 at 5:42 PM CEST, Shivam Kumar wrote:
> Hi all,
>
> I originally reported this issue to security at kernel.org on 2026-03-17
> (Cc Sagi), Message-ID:
> <CA+ysrSJUFi8cHzU8g9Nrbbkcuo0F7vh8CMn3ht15gSk3BbK45A at mail.gmail.com>
> and posted the first patch for it in this thread,
> "[PATCH] nvmet-tcp: bound sgl->length check in nvmet_tcp_map_data()"
> (2026-03-19).
>
> Commit 4a3f002 ("nvmet-tcp: bound SGL data length before allocating
> command buffers"), merged for 7.3, adds the same NVMET_TCP_MAXH2CDATA
> bound with the same status code.

I didn't notice this new patch, but I still suspect that MAXH2CDATA is misused
and that the correct solution is to set MDTS.

Maurizio