[PATCH 3/5] nvmet: zns: reject a NUMD whose byte count wraps

[Andrea Parri]

On Tue, Oct 13, 2026 at 04:26:49PM +0200, Christoph Hellwig wrote:
> > +	/* From U32_MAX / 4 up, the byte count wraps and no longer matches NUMD. */
> 
> Overly long line here.
> 
> > +	if (numd >= U32_MAX / 4 ||
> > +	    out_bufsize < sizeof(struct nvme_zone_report)) {
> 
> I guess to make various sanitizers happy we probably should only
> calculate out_bufsize after bounds checking numd?

Agreed.  For v2 I plan to move the check to the start of
nvmet_bdev_execute_zone_mgmt_recv(), before the handler or its work item
computes (numd + 1) << 2, and to make nvmet_io_cmd_transfer_len() return
0 for such a NUMD, so pci-epf doesn't compute it either.  I'll also keep
the comments within 80 columns.

Thanks,
Andrea