[PATCH v2 0/2] nvme-tcp: two checks on the C2HData receive path

[Yehyeong Lee]

Two problems on the nvme-tcp host receive path, both reachable by a
controller sending a C2HData PDU that does not match the command.

1/2: nothing compares the bytes actually received against the length the
command asked for, so a 4096-byte read answered with 512 bytes completes
as fully successful.

2/2: the C2HData gate reads blk_rq_payload_bytes() without first
checking blk_rq_nr_phys_segments(), the rule commit 25e5cb780e62
("nvme-tcp: fix possible crash in write_zeroes processing") established
for the send path.

Reproduced on v7.2-rc5 against a test target on loopback; no real hardware.

1/2 returns -EPROTO, which resets the controller rather than failing one
command, matching the other protocol-violation returns in this file. I can
fail just the command instead if you prefer.

Link: https://lore.kernel.org/r/20260731143116.1870962-1-yhlee@isslab.korea.ac.kr

Yehyeong Lee (2):
  nvme-tcp: reject a read that transferred too few bytes
  nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone

 drivers/nvme/host/tcp.c | 38 +++++++++++++++++++++++++++++++++++++-
 1 file changed, 37 insertions(+), 1 deletion(-)

-- 
2.43.0