Re: [PATCH 1/2] nvmet-pci: validate queue IDs against endpoint queues
Damien Le Moal <[email protected]>
| Newsgroups | org.infradead.lists.linux-nvme,org.kernel.vger.linux-kernel,org.kernel.vger.stable |
|---|---|
| Organization | Western Digital Research |
| Message-ID | <[email protected]> |
On 7/10/26 11:30, Michael Bommarito wrote:
> The NVMe PCI endpoint transport allocates SQ/CQ arrays using
> ctrl->nr_queues, which is capped by endpoint interrupt capacity. Common
> target admin validation only checks queue IDs against subsys->max_qid, so
> a root-complex host can submit Create/Delete SQ/CQ commands with qids that
> pass the common checks but index past the smaller endpoint transport
> arrays.
>
> Impact: A PCI root-complex host can crash an NVMe PCI endpoint target with
> malformed queue IDs.
>
> Reject queue IDs that are outside ctrl->nr_queues before indexing the
> endpoint SQ/CQ arrays.
>
> Fixes: 0faa0fe6f90e ("nvmet: New NVMe PCI endpoint function target driver")
> Cc: [email protected]
> Assisted-by: Codex:gpt-5-5-xhigh
> Signed-off-by: Michael Bommarito <[email protected]>
Looks good.
Reviewed-by: Damien Le Moal <[email protected]>
--
Damien Le Moal
Western Digital Research