[PATCH] nvmet: don't return memory contents beyond valid data when reading ANA log page

[Keith Busch]

On Wed, Nov 04, 2026 at 12:28:33PM -0500, Ewan D. Milne wrote:
> The host side does not know how much valid data will be returned by the target
> so it will typically provide a buffer larger than the amount of valid data in
> the ANA log page.  The memory allocation used by the target does not guarantee
> that prior kernel memory contents will not be returned past the end of the valid
> page data.  Fix this to ensure that the SGL is zeroed before copying the data.
> 
> Fixes: 72efd25dcf4f ("nvmet: add minimal ANA support")
> Cc: stable at vger.kernel.org
> Signed-off-by: Ewan D. Milne <emilne at redhat.com>
> ---
>  drivers/nvme/target/admin-cmd.c | 9 +++++++++
>  1 file changed, 9 insertions(+)
> 
> diff --git a/drivers/nvme/target/admin-cmd.c b/drivers/nvme/target/admin-cmd.c
> index 26028be8fe4d..bfd5750da27b 100644
> --- a/drivers/nvme/target/admin-cmd.c
> +++ b/drivers/nvme/target/admin-cmd.c
> @@ -543,6 +543,15 @@ static void nvmet_execute_get_log_page_ana(struct nvmet_req *req)
>  	u16 ngrps = 0;
>  	u16 status;
>  
> +	/*
> +	 * The header and one descriptor per enabled group are the only bytes
> +	 * written below; zero the whole transfer first so the unwritten tail
> +	 * does not leak stale kernel memory to the host.
> +	 */
> +	status = nvmet_zero_sgl(req, 0, req->transfer_len);
> +	if (status)
> +		goto out;
> +

Just a minor optimization suggestion, it looks safe to move the zero'ing
to after the code fills out the entries so that we're not writing over
the memory twice. Something like this after the for-loop:
So 
	if (!status && offset < req->transfer_len)
		nvmet_zero_sgl(req, offset, req->transfer_len - offset);