[PATCH v3] nvme: bound FDP config log reads to the received buffer

[Yehyeong Lee]

Thanks, this is cleaner - I've folded all three into v4: the minimum size now
requires the header plus one descriptor, and the per-descriptor check is in the
walk, rejecting dsze < sizeof(*desc) (which also covers the 1..63 values the old
!dsze test let through) and requiring the next descriptor to fit.  I kept
kvzalloc() and the unaligned accessors and added your Suggested-by.

On the get_unaligned part: I reproduced the out-of-bounds reads under KASAN (a
short config log faults nvme_query_fdp_granularity during namespace scan), but I
could not exercise the alignment behaviour as a fault - x86 handles unaligned
access transparently, so it only matters on strict-alignment architectures,
which I do not have.  I verified it only at the code-generation level: on an
-mstrict-align build the accessors emit byte-wise loads where le*_to_cpu()
emitted a single load.  If you would rather not carry an untested hardening, I
am happy to drop the unaligned accessors and keep just the bounds fixes.

Thanks,
Yehyeong