[PATCH v2 5/5] nvme: raise FDP placement handle cap to U8_MAX and warn on overflow

[Guixin Liu]

The RUH status buffer and the placement-handle clamp used S8_MAX - 1
(126) as the maximum descriptor count. That value was picked only so the
io-mgmt-receive result fit in a page, not because of any protocol or
driver restriction.

The meaningful upper bound is U8_MAX: write hints (bio->bi_write_stream)
are u8, so placement handles beyond U8_MAX can never be selected. Size
the buffer and clamp nr_plids to U8_MAX, and emit a dev_warn() when the
device reports more handles than the driver tracks so the truncation is
observable.

Suggested-by: Kanchan Joshi <joshi.k at samsung.com>
Signed-off-by: Guixin Liu <kanie at linux.alibaba.com>
---
 drivers/nvme/host/core.c | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index b1f444cd3daf..19c2fcc0923b 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -33,6 +33,13 @@
 
 #define NVME_MINORS		(1U << MINORBITS)
 
+/*
+ * Write hints (bio->bi_write_stream) are u8, so FDP placement handles beyond
+ * U8_MAX can never be selected. Cap the handle count to bound both the RUH
+ * status buffer and the per-head plids array.
+ */
+#define NVME_MAX_PLIDS		U8_MAX
+
 struct nvme_ns_info {
 	struct nvme_ns_ids ids;
 	u32 nsid;
@@ -2318,6 +2325,7 @@ static int nvme_query_fdp_info(struct nvme_ns *ns, struct nvme_ns_info *info)
 	struct nvme_fdp_config fdp;
 	struct nvme_command c = {};
 	size_t size;
+	u16 nr_plids;
 	int i, ret;
 
 	/*
@@ -2342,7 +2350,7 @@ static int nvme_query_fdp_info(struct nvme_ns *ns, struct nvme_ns_info *info)
 	if (!info->runs)
 		return ret;
 
-	size = struct_size(ruhs, ruhsd, S8_MAX - 1);
+	size = struct_size(ruhs, ruhsd, NVME_MAX_PLIDS);
 	ruhs = kzalloc(size, GFP_KERNEL);
 	if (!ruhs)
 		return -ENOMEM;
@@ -2357,8 +2365,13 @@ static int nvme_query_fdp_info(struct nvme_ns *ns, struct nvme_ns_info *info)
 		goto free;
 	}
 
-	head->nr_plids = le16_to_cpu(ruhs->nruhsd);
-	head->nr_plids = min_t(u16, head->nr_plids, S8_MAX - 1);
+	nr_plids = le16_to_cpu(ruhs->nruhsd);
+	if (nr_plids > NVME_MAX_PLIDS)
+		dev_warn(ctrl->device,
+			 "FDP RUH status reports %u placement handles, capping at %u\n",
+			 nr_plids, NVME_MAX_PLIDS);
+
+	head->nr_plids = min_t(u16, nr_plids, NVME_MAX_PLIDS);
 	if (!head->nr_plids)
 		goto free;
 
-- 
2.43.7