]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
fix up nvme patch
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sun, 8 Feb 2026 14:55:23 +0000 (15:55 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sun, 8 Feb 2026 14:55:23 +0000 (15:55 +0100)
queue-5.10/nvmet-tcp-add-bounds-checks-in-nvmet_tcp_build_pdu_i.patch
queue-5.15/nvmet-tcp-add-bounds-checks-in-nvmet_tcp_build_pdu_i.patch

index 962e982c0f738f7abdf5fcd4c526f6ee2d83b101..80771c2d871754b74fa1e35334a9d0220d90d14b 100644 (file)
@@ -18,15 +18,14 @@ Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
 Reviewed-by: Joonkyo Jung <joonkyoj@yonsei.ac.kr>
 Signed-off-by: Keith Busch <kbusch@kernel.org>
 Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 ---
- drivers/nvme/target/tcp.c | 17 +++++++++++++++++
- 1 file changed, 17 insertions(+)
+ drivers/nvme/target/tcp.c |   18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
 
-diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c
-index 6fd4f74315f6c..a906507bad600 100644
 --- a/drivers/nvme/target/tcp.c
 +++ b/drivers/nvme/target/tcp.c
-@@ -294,11 +294,14 @@ static void nvmet_tcp_free_cmd_buffers(struct nvmet_tcp_cmd *cmd)
+@@ -294,11 +294,14 @@ static void nvmet_tcp_free_cmd_buffers(s
        cmd->req.sg = NULL;
  }
  
@@ -41,7 +40,7 @@ index 6fd4f74315f6c..a906507bad600 100644
        int nr_pages;
  
        length = cmd->pdu_len;
-@@ -306,9 +309,22 @@ static void nvmet_tcp_build_pdu_iovec(struct nvmet_tcp_cmd *cmd)
+@@ -306,17 +309,32 @@ static void nvmet_tcp_build_pdu_iovec(st
        offset = cmd->rbytes_done;
        cmd->sg_idx = offset / PAGE_SIZE;
        sg_offset = offset % PAGE_SIZE;
@@ -53,6 +52,8 @@ index 6fd4f74315f6c..a906507bad600 100644
 +      sg_remaining = cmd->req.sg_cnt - cmd->sg_idx;
  
        while (length) {
+               u32 iov_len = min_t(u32, length, sg->length - sg_offset);
 +              if (!sg_remaining) {
 +                      nvmet_tcp_fatal_error(cmd->queue);
 +                      return;
@@ -61,10 +62,10 @@ index 6fd4f74315f6c..a906507bad600 100644
 +                      nvmet_tcp_fatal_error(cmd->queue);
 +                      return;
 +              }
-               u32 iov_len = min_t(u32, length, sg->length - sg_offset);
++
                iov->bv_page = sg_page(sg);
-@@ -317,6 +333,7 @@ static void nvmet_tcp_build_pdu_iovec(struct nvmet_tcp_cmd *cmd)
+               iov->bv_len = sg->length;
+               iov->bv_offset = sg->offset + sg_offset;
  
                length -= iov_len;
                sg = sg_next(sg);
@@ -72,6 +73,3 @@ index 6fd4f74315f6c..a906507bad600 100644
                iov++;
                sg_offset = 0;
        }
--- 
-2.51.0
-
index de634d8999a01c65deed0ac3944772891d5461b5..71f70e2a5abc0963436fdf27f85b0bf6adcda5fe 100644 (file)
@@ -18,15 +18,14 @@ Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
 Reviewed-by: Joonkyo Jung <joonkyoj@yonsei.ac.kr>
 Signed-off-by: Keith Busch <kbusch@kernel.org>
 Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 ---
- drivers/nvme/target/tcp.c | 17 +++++++++++++++++
- 1 file changed, 17 insertions(+)
+ drivers/nvme/target/tcp.c |   18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
 
-diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c
-index d0fcce6aec93f..9264ce64ed834 100644
 --- a/drivers/nvme/target/tcp.c
 +++ b/drivers/nvme/target/tcp.c
-@@ -306,11 +306,14 @@ static void nvmet_tcp_free_cmd_buffers(struct nvmet_tcp_cmd *cmd)
+@@ -306,11 +306,14 @@ static void nvmet_tcp_free_cmd_buffers(s
        cmd->req.sg = NULL;
  }
  
@@ -41,7 +40,7 @@ index d0fcce6aec93f..9264ce64ed834 100644
        int nr_pages;
  
        length = cmd->pdu_len;
-@@ -318,9 +321,22 @@ static void nvmet_tcp_build_pdu_iovec(struct nvmet_tcp_cmd *cmd)
+@@ -318,17 +321,32 @@ static void nvmet_tcp_build_pdu_iovec(st
        offset = cmd->rbytes_done;
        cmd->sg_idx = offset / PAGE_SIZE;
        sg_offset = offset % PAGE_SIZE;
@@ -53,6 +52,8 @@ index d0fcce6aec93f..9264ce64ed834 100644
 +      sg_remaining = cmd->req.sg_cnt - cmd->sg_idx;
  
        while (length) {
+               u32 iov_len = min_t(u32, length, sg->length - sg_offset);
 +              if (!sg_remaining) {
 +                      nvmet_tcp_fatal_error(cmd->queue);
 +                      return;
@@ -61,10 +62,10 @@ index d0fcce6aec93f..9264ce64ed834 100644
 +                      nvmet_tcp_fatal_error(cmd->queue);
 +                      return;
 +              }
-               u32 iov_len = min_t(u32, length, sg->length - sg_offset);
++
                iov->bv_page = sg_page(sg);
-@@ -329,6 +345,7 @@ static void nvmet_tcp_build_pdu_iovec(struct nvmet_tcp_cmd *cmd)
+               iov->bv_len = sg->length;
+               iov->bv_offset = sg->offset + sg_offset;
  
                length -= iov_len;
                sg = sg_next(sg);
@@ -72,6 +73,3 @@ index d0fcce6aec93f..9264ce64ed834 100644
                iov++;
                sg_offset = 0;
        }
--- 
-2.51.0
-