[PATCH 4/4] nvme: clamp FDP placement handle count to the buffer size

[Christoph Hellwig]

On Thu, Jul 30, 2026 at 12:31:05PM +0800, Guixin Liu wrote:
> nvme_query_fdp_info() allocates the RUH status buffer for at most
> S8_MAX - 1 descriptors and caps the io-mgmt-receive transfer to that
> size. head->nr_plids, however, is taken verbatim from the device-supplied
> nruhsd field, which can be up to 65535. If a non-conformant or malicious
> device reports more descriptors than the buffer holds, the copy loop
> reads past the end of the ruhs buffer (heap out-of-bounds read).
> 
> Clamp nr_plids to the number of descriptors the buffer can actually hold.

Looks good:

Reviewed-by: Christoph Hellwig <hch at lst.de>