From dcc83828b013275bfb358f8ef3ac84cd4f8f4b5f Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sun, 8 Feb 2026 15:55:23 +0100 Subject: [PATCH] fix up nvme patch --- ...unds-checks-in-nvmet_tcp_build_pdu_i.patch | 22 +++++++++---------- ...unds-checks-in-nvmet_tcp_build_pdu_i.patch | 22 +++++++++---------- 2 files changed, 20 insertions(+), 24 deletions(-) diff --git a/queue-5.10/nvmet-tcp-add-bounds-checks-in-nvmet_tcp_build_pdu_i.patch b/queue-5.10/nvmet-tcp-add-bounds-checks-in-nvmet_tcp_build_pdu_i.patch index 962e982c0f..80771c2d87 100644 --- a/queue-5.10/nvmet-tcp-add-bounds-checks-in-nvmet_tcp_build_pdu_i.patch +++ b/queue-5.10/nvmet-tcp-add-bounds-checks-in-nvmet_tcp_build_pdu_i.patch @@ -18,15 +18,14 @@ Reviewed-by: Sagi Grimberg Reviewed-by: Joonkyo Jung Signed-off-by: Keith Busch Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman --- - drivers/nvme/target/tcp.c | 17 +++++++++++++++++ - 1 file changed, 17 insertions(+) + drivers/nvme/target/tcp.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) -diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c -index 6fd4f74315f6c..a906507bad600 100644 --- a/drivers/nvme/target/tcp.c +++ b/drivers/nvme/target/tcp.c -@@ -294,11 +294,14 @@ static void nvmet_tcp_free_cmd_buffers(struct nvmet_tcp_cmd *cmd) +@@ -294,11 +294,14 @@ static void nvmet_tcp_free_cmd_buffers(s cmd->req.sg = NULL; } @@ -41,7 +40,7 @@ index 6fd4f74315f6c..a906507bad600 100644 int nr_pages; length = cmd->pdu_len; -@@ -306,9 +309,22 @@ static void nvmet_tcp_build_pdu_iovec(struct nvmet_tcp_cmd *cmd) +@@ -306,17 +309,32 @@ static void nvmet_tcp_build_pdu_iovec(st offset = cmd->rbytes_done; cmd->sg_idx = offset / PAGE_SIZE; sg_offset = offset % PAGE_SIZE; @@ -53,6 +52,8 @@ index 6fd4f74315f6c..a906507bad600 100644 + sg_remaining = cmd->req.sg_cnt - cmd->sg_idx; while (length) { + u32 iov_len = min_t(u32, length, sg->length - sg_offset); + + if (!sg_remaining) { + nvmet_tcp_fatal_error(cmd->queue); + return; @@ -61,10 +62,10 @@ index 6fd4f74315f6c..a906507bad600 100644 + nvmet_tcp_fatal_error(cmd->queue); + return; + } - u32 iov_len = min_t(u32, length, sg->length - sg_offset); - ++ iov->bv_page = sg_page(sg); -@@ -317,6 +333,7 @@ static void nvmet_tcp_build_pdu_iovec(struct nvmet_tcp_cmd *cmd) + iov->bv_len = sg->length; + iov->bv_offset = sg->offset + sg_offset; length -= iov_len; sg = sg_next(sg); @@ -72,6 +73,3 @@ index 6fd4f74315f6c..a906507bad600 100644 iov++; sg_offset = 0; } --- -2.51.0 - diff --git a/queue-5.15/nvmet-tcp-add-bounds-checks-in-nvmet_tcp_build_pdu_i.patch b/queue-5.15/nvmet-tcp-add-bounds-checks-in-nvmet_tcp_build_pdu_i.patch index de634d8999..71f70e2a5a 100644 --- a/queue-5.15/nvmet-tcp-add-bounds-checks-in-nvmet_tcp_build_pdu_i.patch +++ b/queue-5.15/nvmet-tcp-add-bounds-checks-in-nvmet_tcp_build_pdu_i.patch @@ -18,15 +18,14 @@ Reviewed-by: Sagi Grimberg Reviewed-by: Joonkyo Jung Signed-off-by: Keith Busch Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman --- - drivers/nvme/target/tcp.c | 17 +++++++++++++++++ - 1 file changed, 17 insertions(+) + drivers/nvme/target/tcp.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) -diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c -index d0fcce6aec93f..9264ce64ed834 100644 --- a/drivers/nvme/target/tcp.c +++ b/drivers/nvme/target/tcp.c -@@ -306,11 +306,14 @@ static void nvmet_tcp_free_cmd_buffers(struct nvmet_tcp_cmd *cmd) +@@ -306,11 +306,14 @@ static void nvmet_tcp_free_cmd_buffers(s cmd->req.sg = NULL; } @@ -41,7 +40,7 @@ index d0fcce6aec93f..9264ce64ed834 100644 int nr_pages; length = cmd->pdu_len; -@@ -318,9 +321,22 @@ static void nvmet_tcp_build_pdu_iovec(struct nvmet_tcp_cmd *cmd) +@@ -318,17 +321,32 @@ static void nvmet_tcp_build_pdu_iovec(st offset = cmd->rbytes_done; cmd->sg_idx = offset / PAGE_SIZE; sg_offset = offset % PAGE_SIZE; @@ -53,6 +52,8 @@ index d0fcce6aec93f..9264ce64ed834 100644 + sg_remaining = cmd->req.sg_cnt - cmd->sg_idx; while (length) { + u32 iov_len = min_t(u32, length, sg->length - sg_offset); + + if (!sg_remaining) { + nvmet_tcp_fatal_error(cmd->queue); + return; @@ -61,10 +62,10 @@ index d0fcce6aec93f..9264ce64ed834 100644 + nvmet_tcp_fatal_error(cmd->queue); + return; + } - u32 iov_len = min_t(u32, length, sg->length - sg_offset); - ++ iov->bv_page = sg_page(sg); -@@ -329,6 +345,7 @@ static void nvmet_tcp_build_pdu_iovec(struct nvmet_tcp_cmd *cmd) + iov->bv_len = sg->length; + iov->bv_offset = sg->offset + sg_offset; length -= iov_len; sg = sg_next(sg); @@ -72,6 +73,3 @@ index d0fcce6aec93f..9264ce64ed834 100644 iov++; sg_offset = 0; } --- -2.51.0 - -- 2.47.3