[PATCH 2/5] nvmet: zns: don't leak stale memory in zone management receive

[Keith Busch]

On Mon, Oct 12, 2026 at 04:12:29PM +0200, Andrea Parri wrote:
> A Zone Management Receive report returns the full buffer the host asked
> for, but nvmet_bdev_zone_zmgmt_recv_work() writes only the 8-byte
> Number of Zones field and one 64-byte descriptor for each matching zone
> that fits. The 56 reserved header bytes and every descriptor slot past
> the last match keep whatever the buffer held before. A 4096-byte report
> covering a single zone leaves 4024 bytes unwritten.
> 
> The tcp, rdma and fc transports allocate that buffer with sgl_alloc()
> and pci-epf with kmalloc(), none with __GFP_ZERO, and on success each
> sends the whole buffer to the host (nvmet_setup_c2h_data_pdu() for
> tcp), so the host receives old kernel memory from the target.

Thanks, applied to nvme-7.4.

This one looks good on its own independent of the patch series, so I've
applied this one now and will wait for the comments on the remaining
patches to settle before considering the rest.