[PATCH v3] nvmet-tcp: set and enforce a default MDTS for TCP transport

[Sagi Grimberg]

On 08/05/2026 23:39, Shivam Kumar wrote:
> Unlike other fabrics transports, the TCP target does not set a default
> Maximum Data Transfer Size. With the configfs MDTS entry defaulting to 0
> (no limit), a remote attacker can send a CapsuleCmd with an arbitrarily
> large SGL length, causing sgl_alloc() in nvmet_tcp_map_data() to attempt
> an excessive kernel allocation that triggers the OOM killer.
>
> Set a default MDTS of 9 (2 MiB) for TCP. Enforce the limit server-side
> in nvmet_tcp_map_data() by rejecting commands whose SGL length exceeds
> the configured MDTS, returning NVME_SC_INVALID_FIELD as required by the
> NVMe specification. Admins can still adjust via the configfs mdts
> attribute if needed.
>
> Signed-off-by: Shivam Kumar <kumar.shivam43666 at gmail.com>
> ---
>   drivers/nvme/target/tcp.c | 10 ++++++++++
>   1 file changed, 10 insertions(+)
>
> diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c
> index 164a564ba3b4..098cf877c358 100644
> --- a/drivers/nvme/target/tcp.c
> +++ b/drivers/nvme/target/tcp.c
> @@ -25,6 +25,7 @@
>   #define NVMET_TCP_DEF_INLINE_DATA_SIZE	(4 * PAGE_SIZE)
>   #define NVMET_TCP_MAXH2CDATA		0x400000 /* 16M arbitrary limit */
>   #define NVMET_TCP_BACKLOG 128
> +#define NVMET_TCP_DEF_MDTS		9 /* 2 MiB (2^(12+9)) */
>   
>   static int param_store_val(const char *str, int *val, int min, int max)
>   {
> @@ -422,6 +423,13 @@ static int nvmet_tcp_map_data(struct nvmet_tcp_cmd *cmd)
>   	if (!len)
>   		return 0;
>   
> +	/* Enforce MDTS: abort commands exceeding the advertised limit */
> +	if (cmd->req.port->mdts) {
> +		u8 mdts = cmd->req.port->mdts;
> +		if (mdts < 20 && len > (1U << (12 + mdts)))
> +			return NVME_SC_INVALID_FIELD | NVME_STATUS_DNR;
> +	}
> +
>   	if (sgl->type == ((NVME_SGL_FMT_DATA_DESC << 4) |
>   			  NVME_SGL_FMT_OFFSET)) {
>   		if (!nvme_is_write(cmd->req.cmd))
> @@ -2077,6 +2085,8 @@ static int nvmet_tcp_add_port(struct nvmet_port *nport)
>   	INIT_WORK(&port->accept_work, nvmet_tcp_accept_work);
>   	if (port->nport->inline_data_size < 0)
>   		port->nport->inline_data_size = NVMET_TCP_DEF_INLINE_DATA_SIZE;
> +	if (nport->mdts < 0)
> +		nport->mdts = NVMET_TCP_DEF_MDTS;
>   
>   	ret = sock_create(port->addr.ss_family, SOCK_STREAM,
>   				IPPROTO_TCP, &port->sock);

Shivam,

I think what we want is to limit the tcp to a sane limit similar to the 
nvmet-rdma driver.
Also, we probably want it at least consistent with the (rather 
arbitrary) MAXH2CDATA...

e.g. something like:
--
diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c
index 20f150d17a96..32f33e5dbfdb 100644
--- a/drivers/nvme/target/tcp.c
+++ b/drivers/nvme/target/tcp.c
@@ -24,6 +24,7 @@

  #define NVMET_TCP_DEF_INLINE_DATA_SIZE (4 * PAGE_SIZE)
  #define NVMET_TCP_MAXH2CDATA           0x400000 /* 16M arbitrary limit */
+#define NVMET_TCP_MAX_MDTS             12
  #define NVMET_TCP_BACKLOG 128

  static int param_store_val(const char *str, int *val, int min, int max)
@@ -2220,6 +2221,11 @@ static ssize_t nvmet_tcp_host_port_addr(struct 
nvmet_ctrl *ctrl,
                         (struct sockaddr *)&queue->sockaddr_peer);
  }

+static u8 nvmet_tcp_get_mdts(const struct nvmet_ctrl *ctrl)
+{
+       return NVMET_TCP_MAX_MDTS;
+}
+
  static const struct nvmet_fabrics_ops nvmet_tcp_ops = {
         .owner                  = THIS_MODULE,
         .type                   = NVMF_TRTYPE_TCP,
@@ -2231,6 +2237,7 @@ static const struct nvmet_fabrics_ops 
nvmet_tcp_ops = {
         .install_queue          = nvmet_tcp_install_queue,
         .disc_traddr            = nvmet_tcp_disc_port_addr,
         .host_traddr            = nvmet_tcp_host_port_addr,
+       .get_mdts               = nvmet_tcp_get_mdts,
  };

  static int __init nvmet_tcp_init(void)
--