From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 32B5A3BED11 for ; Mon, 27 Jul 2026 20:03:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785182630; cv=none; b=AxQbK8zwM8Dro/2dGMrBHoXjUD5Yi+xHf6uaZ5G5GOBvJ+6jqZczsc6zHmu35RKczWMBdoaX9Fwj85rHfHLQv2EJDmwQXkHWRIhGS7Z31ynlG8V6fdyPjWTwskfZPgkYzIn5+YE4stOShwc3Me1EPotSPAw2UoXDm/LYyWK7kM8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785182630; c=relaxed/simple; bh=fXuDlQj6YFbtZKzoRbu1BeZPvoNDU0BFV/CFrZNp9do=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To:Cc; b=AnM6UrefGq1SbgaX+S5Vy1TZMrkeoSpGW5Ex9Q6B5ErmYEsogj78HwMNNqcGKjkIwIshTSEv3gbjvEJLeKx8xVbWSBkCTzf53aeCU05vYAWbd1s9d0LnW7pkY22JrbcgRJ5i4lmpaNkrNepQyUwTpwNUpIbeA3U84GKJDjj2/rE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=WgtTHNSf; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="WgtTHNSf" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 42B4B1F000E9; Mon, 27 Jul 2026 20:03:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1785182624; bh=wgULkT/0QEhLC7JJzVigtPu4uZ9cypSWR2LIyrTDAfg=; h=From:Date:Subject:To:Cc; b=WgtTHNSfsFSshfrrVDi4GdI8QQXd64F2WwnHu3HMVl9lBWUYCO5mhexltNTLgKXUh 9t9NY9pX7byNOOtNHM6Hlq5u3NG14GqviW4IG+0EOHHhullc/onxmjbgISms2OCEKk t4dp6Zp9C+poyIGb8tU0vPk3HK1dwPSBMli4NZ14= From: Greg Kroah-Hartman Date: Mon, 27 Jul 2026 22:03:31 +0200 Subject: [PATCH] nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20260727-nvme-tcp-v1-1-61c0e36763eb@linuxfoundation.org> X-B4-Tracking: v=1; b=H4sIAAAAAAAC/yXM0QpAMBTG8VfRubaaiZVXkQs7Do4ya0NqeXfD5 a/+3xchkGcK0GQRPJ0ceLMJRZ4Bzr2dSPCQDEqqWmqlhT1XEjs6USGSHHVpJCKk3Hka+fqu2u5 3OMxCuL97uO8HOIh7iWwAAAA= X-Change-ID: 20260727-nvme-tcp-5cce0f73b0cc To: Christoph Hellwig , Sagi Grimberg , Chaitanya Kulkarni Cc: linux-nvme@lists.infradead.org, linux-kernel@vger.kernel.org, stable , Greg Kroah-Hartman X-Mailer: b4 0.16-dev-401aa X-Developer-Signature: v=1; a=openpgp-sha256; l=1962; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=fXuDlQj6YFbtZKzoRbu1BeZPvoNDU0BFV/CFrZNp9do=; b=owGbwMvMwCRo6H6F97bub03G02pJDFnpO6c81350uOvVV/Gs7YccFi6xZXRL1L56u1myOWirY TO/B8+sjlgWBkEmBlkxRZYv23iO7q84pOhlaHsaZg4rE8gQBi5OAZiI0X2GBaeKpMrYNOS9+KeH SYSduVl75bvtdoYFS+WaV+bHmxZomW1mdH/28d90q4peAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 When fuzzing the nvme target code, I tripped a kernel warning in nvmet_tcp_map_data() because the length passed into the allocator is controlled by the remote initiator. A remote initiator that sends a command with an SGL claiming a huge number, can create a scatterlist and iovec allocation of over 1 million entries, which causes the backing kmalloc call to exceed MAX_PAGE_ORDER and then the page allocator will trip on a WARN_ON_ONCE_GFP() message: WARNING: mm/page_alloc.c:5280 __alloc_frozen_pages_noprof Workqueue: nvmet_tcp_wq nvmet_tcp_io_work ... sgl_alloc_order nvmet_tcp_map_data nvmet_tcp_try_recv_pdu As it's never good to trip a kernel warning remotely due to many systems having panic-on-warn enabled, let's silence it by just add GFP_NOWARN to the allocation flags. Assisted-by: gkh_clanker_2000 Cc: stable Signed-off-by: Greg Kroah-Hartman --- drivers/nvme/target/tcp.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c index 75a276d73be3..d61622ed8dd8 100644 --- a/drivers/nvme/target/tcp.c +++ b/drivers/nvme/target/tcp.c @@ -433,13 +433,14 @@ static int nvmet_tcp_map_data(struct nvmet_tcp_cmd *cmd) } cmd->req.transfer_len += len; - cmd->req.sg = sgl_alloc(len, GFP_KERNEL, &cmd->req.sg_cnt); + cmd->req.sg = sgl_alloc(len, GFP_KERNEL | __GFP_NOWARN, &cmd->req.sg_cnt); if (!cmd->req.sg) return NVME_SC_INTERNAL; cmd->cur_sg = cmd->req.sg; if (nvmet_tcp_has_data_in(cmd)) { - cmd->iov = kmalloc_objs(*cmd->iov, cmd->req.sg_cnt); + cmd->iov = kmalloc_objs(*cmd->iov, cmd->req.sg_cnt, + GFP_KERNEL | __GFP_NOWARN); if (!cmd->iov) goto err; } --- base-commit: f5098b6bae761e346ebcd9da7f95622c04733cff change-id: 20260727-nvme-tcp-5cce0f73b0cc Best regards, -- Greg Kroah-Hartman